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record and track your actions taken, and add columns as desired to add detail to your 
documentation. The key point is to use whatever application works best for your operations 
but to always track and document your changes. 


Adding and Removing Cloud Resources 


Over time, and as part of the ongoing operations of your cloud deployment, resources will 
be added and removed to tune and maintain your cloud presence. In this section, you will 
learn about managing your resources. 


Determining Usage Patterns 


Usage patterns can be based on your collected metrics and baseline data. Also, a complete 
and up-to-date set of documentation can help in planning and understanding the details of 
your deployment and traffic flows. 

Cloud monitoring and management applications allow you to view trend graphs of usage 
over a defined timeline. Also, logging data can be viewed with analytics software to deter- 
mine detailed usage patterns based on your requirements. 


Bursting 


Cloud bursting is a hybrid model that is most commonly found in private cloud deploy- 
ments that are designed to use public cloud processing during times of increased load. This 
is often an economical approach to accessing additional resources when required. Your 
company does not need to make capital investments for infrequently used reserve capacity. 
When your local resources are at capacity, the pay-as-you-go model of the public cloud can 
be utilized, and the additional capacity can be used and billed for when it is needed. Then 
it can be deleted and no longer charged for when activity returns to normal, and the private 
data center can handle the workload without the added, or burstable, capacity. 


Migrating Between Cloud Providers 


In a hybrid cloud, more than one cloud service is utilized. Given that all the cloud provid- 
ers’ data centers are virtualized operations, is it possible to move workloads between them? 
The answer is often a definite “maybe” or “it depends”! 
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This requires some background research and engineering to pull off. Where there is 
commonality between service providers, there are also proprietary implementations that 
may prevent a simple migration between cloud providers. Generally speaking, the higher up 
the stack you go, from IaaS to PaaS to SaaS, the more difficult it will be to migrate. With 
IaaS, most of the cloud operations are under your direct control, which gives you the most 
flexibility to migrate. However, if the cloud provider controls the application, you may not 
have many options to migrate. 

There are companies and software applications that specialize in migrations between 
cloud providers and that make sure all the formats and configurations are compatible 
between the providers. 

It’s also important to review the financials involved in a migration to make sure you do 
not have any long-term contractual commitments with the cloud provider you are migrat- 
ing away from and are not forced to pay for stranded resources. 


Scaling Resources to Meet Requirements 


Again, one of the primary benefits of the cloud is that cloud computing enables a utility 
business model that charges you only for the resources you consume. This model enables 
you to scale your cloud fleet to meet its current workload and be able to add and remove 
capacity as needed. This ability to scale enables financial savings as you are no longer pay- 
ing for resources and systems when they are not being used. 

In this section, you will learn about some of the options available, and techniques used, 
to scale resources to meet your current workloads. 


Cloud Bursting 


I discussed cloud bursting earlier in this chapter, and you learned that it is the model 
where a primary data center carries the current compute load, and when additional capac- 
ity is required, a remote cloud can assist with the load. Basically, one cloud is primary and 
can “burst” to a backup cloud if additional capacity is required to meet a peak demand 
situation. 


Scaling Up and Scaling Out 


Adding capacity to your cloud deployment is referred to as scaling. To scale your cloud, you 
decide whether you need to scale up or scale out. 

Scaling up, or vertical scaling, will add resources such as CPU instances or more RAM. 
When you scale up, you are basically increasing your compute, network, or storage capa- 
bilities, as shown in Figure 7.3. Many applications, such as databases, will perform better 
after a system has been scaled vertically. For example, a system that is CPU bound will per- 
form better when scaling up with additional CPU cores. The same is true with applications 
that benefit from more RAM or higher Local Area Network (LAN) throughput. 
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FIGURE 7.3 _ Vertical scaling 
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Vertical or Scale Up Increases the Capacity 
of an Existing Server 


Scaling out, or horizontal scaling, adds more nodes instead of increasing the power of 
the nodes, as shown in Figure 7.4. So, with horizontal scaling, you will choose to add more 
servers to the existing configuration. This is a common scenario because the cloud data 
center uses cost-effective commodities or white-box servers. With horizontal scaling, you 
need to run applications that are distributed and are designed to work in parallel with each 
other. With a busy cloud website, horizontal scaling works well by adding web servers to 
handle the additional workload and implementing a load balancer to distribute the load 
between the many web servers. This arrangement is more efficient and reliable than a single 
server that has been scaled vertically by adding more LAN bandwidth, CPU cores, and 
RAM to handle the additional web load, but it is still a single point of failure. 


FIGURE 7.4 _ Horizontal scaling 
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Horizontal or Scale Out Adds More Servers 
for Additional Capacity 


It is important to check the cloud provider’s offerings and what options it offers when 
you are deciding whether to scale vertically or horizontally. The provider may offer better 
pricing options for multiple smaller systems than an equivalent larger system. The larger 
VM is a single management point as compared to multiple horizontally scaled systems, but 
it is also a single point of failure. When deciding to use the horizontal approach, you must 
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consider that you need to manage more systems, and the distributed workloads between the 
systems may cause some latency that is not found in a single larger server. There is also a 
third option, referred to as diagonal scaling, which is a combination of scaling up to more 
powerful systems and scaling out by deploying more of these scaled-up systems. It is com- 
mon to use horizontal scaling combined with load balancing on the Internet-facing web tier 
and vertical scaling for the backend databases, since many database applications operate 
more efficiently on a single larger server than multiple small servers. Choosing the best 
approach usually comes down to each particular use case, the application capabilities, and 
the cloud provider’s pricing structure. 


Reducing Capacity 


Just as you are able to add capacity and scale up, it is also easy to reduce the cloud capacity 
needs after they are no longer needed. The ability to reduce capacity is normally defined in 
the scaling policies that monitor system utilization over time. For example, if your work- 
load decreases after a scaling or cloud burst event, you may set the metric to be if the web 
server’s CPU utilization remains below 50 percent for 5 consecutive minutes. When this 

is triggered, the scaling application will use the cloud orchestration systems to remove 
unneeded servers and reduce both capacity and cost. 


Scaling in the Hybrid-Based Cloud 


Most clouds today are based on the hybrid model, and single cloud deployments are becom- 
ing increasingly uncommon. Some organizations may have many clouds under their man- 
agement based on their varied needs and use cases. Hybrid cloud scaling uses the additional 
capacity of another cloud for scaling; this is by definition cloud bursting and has been 
reviewed earlier in this chapter. 


Community Cloud Scaling 


A community cloud is a cloud where users with common interests or requirements access 
shared resources. These specialized cloud providers offer a wide array of different services 
and can be vastly different in their offerings and capabilities. As such, the ability to scale 
using a community cloud will be highly dependent on the capabilities of each individual 
community cloud provider. 

However, it is helpful to remember that all clouds are, at their core, automated data 
centers controlled by software. So, if it is a community, public, or private cloud, the 
underlying capabilities are largely the same but may be different in scale and orchestration 
capabilities. 


Scaling the Public Cloud 


The public cloud is generally where the hyperscale data centers are, and massive scaling 
takes place. The business model is a pay-as-you-go utility service designed for large-scale 
deployments. Some of the larger public cloud providers can scale to thousands of servers on 
demand and offer many pricing options to meet your requirements. 
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Public cloud utilities, applications, and orchestration systems are designed for elastic 
computing operations. These tools and features are used to differentiate themselves from 
their competitors and make scaling easy to implement for their customers. 


Scaling the Private Cloud 


Private cloud scaling can be more difficult to implement depending on the scale of the data 
centers. If there is sufficient reserve compute capacity, then the automation and orchestra- 
tion systems can be implemented just as they are in the public cloud. However, most private 
operations do not care to have the excess compute capacity sitting in a rack, powered up, 
and not being used. This is a large additional cost to a company that may be better served 
using a cloud bursting design. 


Elasticity 


The ability to automatically and dynamically add resources such as storage, CPUs, mem- 
ory, and even servers is referred to as elasticity. This is done “on the fly” as needed and is 
different from provisioning servers with added resources that may be required in the future. 
This allows cloud consumers to automatically scale up as their workload increases and then 
have the cloud remove the services after the workload subsides. With elastic computing, 
there no longer is any need to deploy servers and storage systems designed to handle peak 
loads—servers and systems that may otherwise sit idle during normal operations. Now you 
can scale the cloud infrastructure from what is the normal load and automatically expand 
as needed when the occasion arises. 


Extending the Scope of the Cloud 


As part of your ongoing operations, it will likely be advantageous to add new features and 
capacity to your deployment. This is often referred to as extending the scope, and with the 
dashboard management and configuration systems most cloud providers offer, the exten- 
sions are very straightforward depending on what you want to accomplish. 

Cloud providers are constantly releasing new products and enhancing existing offerings. 
There are a lot of new capabilities to take advantage of, and it is a natural progression to 
expand your scope of solutions to enhance your operations. 


Understanding Application Life Cycles 


All information technology hardware and software will have a normal cycle of usefulness. 
This is often referred to as the application life cycle and is the management of a software 
application from the initial planning stages through to its retirement. In this section, you 
will learn about the complete cycle as you most certainly will work with it in your career as 
a cloud engineer. 

The life cycle process breaks the phases of an application into units such as deployment, 
upgrades, retirements, replacements, migrations, and feature additions or deletions as well 
as removal. 
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Deployments 


The deployment phase of the application life cycle includes one or more of the following: The 
solution architects must determine the software requirements and work with the development 
team if required, and other items in the deployment phase may include coding, testing, 
configuring, and validation. 


Upgrades 


As was reviewed in Chapter 5, upgrades are a natural part of an application life cycle, and 
there are many different types of upgrades and patching that can occur. It is important to 
remember that software will most likely undertake many upgrade cycles over its lifetime, 
and each upgrade will need to be managed through the change management process. 


Migrations 


When a new application is brought online, there may be a need to migrate or move data from 
an older application or data store. Migrations need to be project-managed and controlled as 
part of both the life cycle and change process. If the applications are significantly different, 
the format of the user data may need to be modified as part of the migration process. 


Feature Additions and Deletions 


An application will undergo upgrades and modifications over its lifetime. Some will be to 
resolves issues through the patching process, and others will be to add new features as they 
are released. While less common, features can also be removed to save money by not paying 
for unused license fees. 


Replacements 


Over time applications will be replaced, and the process of project management to assist in 
replacing the existing application with a new or different approach must take place. This is 
a normal part of the lifecycle process. 


Retirements 


Applications will, at some point, be removed after having their data migrated to a new sys- 
tem or replaced. This is the end of the complete life cycle, and it will most likely start over 
with the deployment of a replacement application. 


Corporate Changes 


Over time, there are often ongoing changes to your corporation and its cloud computing 
requirements. Corporations can be constantly changing entities as they grow and shrink in 
size, and as they enter and exit markets, there may be legal or regulatory changes they must 
contend with. There can also be mergers and acquisitions that can have a major impact on 
their IT and cloud operations. 
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With a pay-as-you-use-it model, you can design and deploy a test bed for the new com- 
pute operations and then tear it down when it is no longer needed. The cloud allows for a 
cost-effective way of testing new designs since there is no large capital expenditure required 
to build a test site. 


Mergers, Acquisitions, and Divestitures 


Probably the most disruptive event that can happen to a corporation is that of a merger, 
acquisition, or spin-off of an operation. These will usually necessitate a sizable and poten- 
tially disruptive impact on its IT operations. 

You should be prepared to work with new groups and departments to look at how the other 
company’s cloud deployment is architected and what options are available to integrate them. 
Applications may be duplicated, and there could be efficiencies gained by integrating them. 

This is usually a large and sometimes complex undertaking where attention to detail 
is your key to success. All interested parties must participate in this project management 
undertaking, and care must be taken to achieve success. 


Cloud Service Requirement Changes 


Cloud services can include many different offerings that a cloud provider sells. For exam- 
ple, services such as firewall or load balancer capabilities may change over time, compute 
services are constantly being added, and your requirements may change over time. Pricing 
for new services may be preferred to the older offerings you are operating on and that the 
cloud provider wants to depreciate. 

It is recommended that your company keep up-to-date on new services, feature addi- 
tions, pricing models, and trends in the cloud to see whether you can gain a competitive 
advantage and introduce efficiencies to save money on the new systems. 

Be aware that these new offerings and changes to existing offerings can change at a 
rapid pace. Every week it seems, the cloud companies announce a bewildering number of 
new products and features! 


Regulatory and Law Changes 


Of course, there is always going to be changes on the legal and regulatory landscape, this is 
an important area to keep track of as changes can have a direct and long lasting impact on 
your operations. Also, if you are a regulated entity, you may be audited for compliance, and 
if you fail, it could have a devastating effect on your operations. 

Depending on the changes, there may be no effect to your operations, but the cloud pro- 
vider may need to make changes in their infrastructure or you may be responsible for the 
implementation of the change. It is important to coordinate and track changes of this type 
as required for business continuity. 


Managing Account Provisioning 


There seems to be an ongoing and seemingly never-ending stream of account changes. This 
can be because of users arriving or leaving your company or the addition of contractors or 
short-term agreements that require users to access systems. 
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The request for account provisioning may come from human resources, the project 
manager, or any number of other sources. Each account will need access rights to varied 
services, and all of this data must be entered into a directory service or cloud user database. 
This can be a manual process or automated with orchestration systems or by establishing 
confederations of user account systems. 


Account Identification 


Cloud accounts will have different methods to identify them that may include a domain 
name, an incomprehensible long number string, or a user-defined identification number. 

It is important that the root account manager for the account keep detailed records 
of each account for management and billing purposes. Also, it is common for a single 
corporation or entity to have many different account databases, with the same or 
multiple cloud companies, and it can become difficult to manage that many different 
accounts. To rectify this, some cloud providers are able to consolidate a large number 
of accounts owned by a corporation for single billing and other global management ser- 
vices such as DNS. 


Authentication 


Authentication was a topic that you learned about in Chapter 2, and we will do a quick 
review here. 

Authentication is the process of determining the identity of a client usually by a login 
process. When you authenticate a user, you determine the identity of that user and can 
authorize or grant permissions to cloud resources by either allowing or denying access to 
specific resources. 

User authentication usually consists of a username and password combination or some 
variation of that, such as a token or biometric access method. Cookies can be used for web 
access to identify and authenticate a user connecting to your website. 


Federations and Single Sign-On 


You also learned about federations and single single-on in Chapter 2. Here We will give a 
quick review as it is listed as an objective for this section. 

When you have different organizations, the limited capacity for locally-defined users can 
exceed the capacity of the cloud provider’s limits. Or you want to use your internal direc- 
tory system so that the federated approach will meet your requirements. 

A federation includes external user systems, primarily Active Directory, as a user reposi- 
tory for your cloud user accounts. The federated approach can eliminate the need to keep 
two sets of user account data and also allows your cloud deployment in be accessed by other 
groups or companies that integrate with your user accounts using the federated approach. 

A single sign-on architecture allows for your users to authenticate just one time with the 
cloud and be able to access all of the services they have rights to without having to log into 
each one individually. SSO allows you to centralize authentication systems into a single sys- 
tem and eases administration as you do not have to manage multiple accounts for the same 
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user. Directory systems using the Lightweight Directory Access Protocol (LDAP) are an 
example of SSO systems where you log into the directory services just one time, and based 
on your rights, you are allowed to access systems in the network without any additional 
login requirements. Single sign-on eliminates the need to remember multiple username and 
password combinations and saves the time of having to enter your authentication informa- 
tion over and over as you log into different systems. 


Authorization 


After a user has supplied their login credentials, which is usually a username/password 
combination, the cloud will have a positive identification and be able to reference the func- 
tions they are allowed to perform and the systems they are allowed to access. This is known 
as the authorization process. 

Access control systems will assign specific roles and duties to users or groups of users. 
For example, database administrators can be given full access to manage a database appli- 
cation but be restricted from performing VM or storage operations. 


Access Control List Authorization Methods 


The access control list for user authorization may share the same name as a network ACL, 
but, here, we are referring to what authorization a user is granted after being authenticated, 
or logging into, a system or directory. 

Access control systems are user configurations that grant roles and duties to users or 
groups of users and also systems such as VMs, applications, and storage volumes. 


Permission-Based Authorization 


A user can be granted permissions after they have been identified through the authoriza- 
tion, or login, process. The permissions may be the cloud provider’s identity and access 
management systems, a directory service accessed through a federation, user accounts 
accessed via LDAP, or local access control systems on the cloud user base, or a system such 
as a virtual machine with local access control that is independent from cloud-based authen- 
tication systems. 


Managing the Account Life Cycle 


As you learned in maintaining user accounts in Chapter 6, it is important to keep track of 
all user accounts and, if necessary, delete or modify them as needed. In this section, we will 
expand on that and review the account life cycle. 


Policy 


When creating or managing an account, a policy can be defined and applied that defines 
access rights, any time limits, and groups to which the user belongs. 
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Lockout 


A lockout policy can be applied to an account that defines the parameters that create a 
lockout event. It is most common to apply a lockout policy to failed login attempts. For 
example, you can define a policy where four failed login attempts in five minutes will dis- 
able an account for thirty minutes. A lockout policy will most likely be defined by your 
information security group, and you may be asked to create and apply the policy as part of 
your duties. 


Password Complexity 


Another policy that will most likely be defined by the IT security groups is that of password 
complexity and reuse. Passwords that are too short or basic or are in place for a long period 
of time are security risks. The IT security group will most likely be the ones that dictate the 
complexity of the password and its life cycle. 

For example, a password may be required to be a nondictionary word that is eight or 
more characters in length and contain at least one uppercase letter and a special character. 
It is also typical to have a rotation policy that requires you to create a new password on a 
regular basis such as every 30 days, for example. 

To configure password complexity policies, the cloud configuration interface will have 
fields for these in the user or server login configuration dialog boxes. 


Account Automation and Orchestration 


Accounts can be managed with automation systems that use scripts to access device APIs 
that allow machines to automate cloud configuration functions. As discussed throughout 
this book, the cloud can be looked at as one big programmable device! As such, any fea- 
ture or function that you configure with a web interface or a CLI is actually just a front 
end interface to an API. This is an important concept to understand. All automation and 
orchestration systems are scripted, and often reused code is used to control the cloud 
deployment. 


User Account Creation 


Account creation can be automated to prevent the laborious task of entering into the user 
database a large number of individual accounts. User data can be collected in many differ- 
ent manners including a web form. 

For example, your e-commerce website may have an area for new users in its user login 
screen. The new user data can be collected, and on the backend a RESTful API script 
can be generated to create the user account at your site. Batch accounts can be created by 
accessing a database of new users such as students signing up for a new class you are offer- 
ing this fall where all student data was previously collected in a SQL database. 
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User Permission Settings 


Users can be granted permissions at the account level to perform a wide array of opera- 
tions. The capability to manage cloud operations may allow the administrator to add, 
remove, or modify user accounts and permissions. 

User permissions can be defined at the user level or by making the user a part of a group 
and assigning permissions to the group. 


Resource Access Definitions 


User accounts can allow access to approved resources, and these permissions contain any 
number of rights such as read/write permissions for a storage volume and access to run cer- 
tain applications. Access permissions can be defined, and you can specify details on what 
functions the user is allowed to perform. 


Removing Accounts 


Part of a solid IT security operation is to remove any accounts, polices, or services that are 
no longer active. In Chapter 6 you learned about user account maintenance and the impor- 
tance of tracking and removing accounts that will no longer be used. There are manage- 
ment applications that can assist in the identification of accounts that need to be removed. 
Also, automation systems can be employed to automate the accounts flagged for removal. 


Disabling User Accounts 


There is also an option of disabling a user account in many cloud management consoles. 
The ability to disable an account can be helpful in situations where the account will need to 
be re-activated at a future date and does not need to be deleted. Account disablement can 
be managed in the same manner as other account operations with a web front end or with 
the use of APIs for scripted and automated processes. 


Summary 


This chapter focused on the management operations of your cloud deployment. The subject 
of collecting monitoring and management data was covered. Once the data has been col- 
lected, a baseline can be determined by monitoring key data measurement points over a 
defined period of time. The baseline information can be used to determine future expansion 
and growth of the cloud. Also, if a system deviates too far from what is considered to be 
normal, which is the baseline, a trigger can be created to alert that there may be a problem. 
You learned about notification systems that process the alerts and distribute them to users 
and systems using such channels as text, e-mail, and API calls. 

The chapter also went into detail on determining whether your resource allocations are 
correct and the options available to add or remove capacity. Support agreements are critical 
for ongoing management of your cloud fleet. You learned about cloud providers’ support 
structures and responsibilities. 
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Configuration and change management are ongoing cloud management tasks. In this 
chapter, you learned about backing up and recording your device configurations and what 
the change management process is, as well as the roles that the various groups and pro- 
cesses play in making sure that changes are implemented properly and that the risk of an 
error is minimized. 

Your cloud fleet will most likely be dynamic and require constant changes as your needs 
expand and contract. You became familiar with usage patterns and how cloud bursting 
works and what its advantages are. Autoscaling systems allow you to add and remove 
resources based on measured loads and to automate your operations by taking advantage of 
the elasticity features of the virtualized cloud data center. 

An important topic is application lifecycle management. You were introduced to the con- 
cepts of lifecycle management and the stages that are common as an application is designed 
and deployed, through upgrades and ultimately retirement. 

Cloud management will be driven by changing business requirements. Business disrup- 
tions such as mergers, acquisitions, and spin-offs all can have major impacts on cloud man- 
agement. Other business-related topics include regulatory changes and how new laws may 
impact your operations and require that you make changes to meet new requirements. 

The topic of user account management was revisited and expanded upon. You learned 
about identification and authentication, what a federated system is, and the advantages that 
can be gained by accessing user data using an external directory. User access control and 
permissions are defined to determine what systems a user or system can access and what 
actions they are allowed to perform on the system. Single sign-on, password management, 
user account creation, and disablement ended this chapter on cloud management. 


Exam Essentials 


Know what a metric is. Know that a measurement is a metric and can be any number 

of objects that you select to monitor such as CPU utilization or disk reads. By collecting 
metrics, you can determine trends in your usage. The exam may give a long scenario-based 
question that can be solved by focusing on metrics and what they are used for. 


Understand baselines and anomalies. A baseline is what is considered to be normal opera- 
tions, and values above or below the baseline are considered to be anomalies. There may be 
questions that test you in your knowledge to distinguish between the two terms. 


Know alerting, methods, and, triggers, and notifications. Alerting is the process determining 
that there is a value out of variance and notifying either people or machines that an event has 
occurred and needs attention. Know what event triggers are and how basic notifications work. 


Understand cloud management support agreements and responsibilities. Cloud compa- 
nies offer a basic support plan that is usually free of charge but limited in scope. Premium 
service agreements are offered with varying levels of support commitments. You may be 
asked a question on who is responsible given a scenario of an outage. 
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Know what change and configuration management is. Configuration management is the 
tracking and documentation of ongoing changes to device configurations including what 
changes were performed, by whom, and at what time. Change management is a complete 
process that monitors and manages all changes that are made to your cloud fleet. For the 
exam, understand the role of the change advisory board and the approvals documentation 
that are part of an effective change management plan. 


Understand resource management. You may be asked about migrating between cloud 
providers or how you would address issues where you need to either add or remove cloud 
computing capacity. Know the various ways to scale, such as cloud bursting, scale up and 
out, and scaling issues with the various cloud deployment models. 


Know what the application life cycle is. For the exam, you should be able to answer ques- 
tions that outline the life of an application from its initial design, deployment, updates, 
migrations, feature changes, replacement, and finally retirement. 


Know about how corporate changes can affect the cloud. Corporate mergers, acquisi- 
tions, spin-offs, legal, and regulatory changes may be presented in the form of a long sce- 
nario question that requires you to select the specific corporate issue to resolve. 


Understand user accounts. User account management includes authentication, authoriza- 
tion, federations, and single sign-on systems. Other topics that are fair game for the exam 
include account management such as new users, password complexity, polices, removing 
old accounts, and permission settings. User accounts are an important part of ongoing 
cloud management, and you should expect several questions that test your knowledge of 
the topic. 


Written Lab 


Fill in the blanks for the questions provided in the written lab. You can find the answers to 
the written labs in Appendix B. 


1 A is a standard of measurement that defines the conditions and the rules for 
performing the measurement and for understanding the results of a measurement. 


2. Using metrics data to trigger systems, you can use thresholds to react to 
events at all layers of your cloud deployment. 


3. Once Harry has determined what is considered to be a baseline during normal web 
server operations, he can use that as a reference to determine what is considered to be 
a or a system that is reporting metrics that are either above or below his 
expectations. 


If the event is deemed to be critical, alerts can be generated by configuring a 


As a general rule, the cloud providers will be responsible for the underlying 3 
and if it is not defined in the , it will be your responsibility to maintain. 


10. 
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is the process of managing all aspects of the ongoing upgrades, 
repairs, and reconfigurations. 


The management of a software application from the initial planning stages through to 
its retirement is referred to as 


Users can be granted __at the account level to perform a wide array of opera- 
tions. The capability to manage cloud operations may allow the administrator to add, 
remove, or modify user accounts and the services they are allowed to access. 


Enforcing password may require a nondictionary word that is eight or more 
characters in length and contain at least one uppercase letter and a special character. 


All change request documents must include a detailed formal plan on the steps to be 
taken to implement, and if required, the changes. 
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Review Questions 


The following questions are designed to test your understanding of this chapter’s mate- 
rial. For more information on how to obtain additional questions, please see this book’s 
Introduction. You can find the answers in Appendix A. 


1. Carol is collecting information on objects to monitor in her community cloud deployment. 
She is interested in establishing a baseline to produce a trend analysis report. What are 
some objects that she could natively monitor? (Choose all that apply.) 


Availability 

Instance initialization time 
Task runtime 

Total storage capacity 
MTBF 

None of the above 

All of the above 
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2. TipoftheHat.com’s IT department wants to know what its normal day-to-day web hit count 
is so it can plan for the upcoming holiday selling season. Jim’s job is to measure the incom- 
ing web requests and graph them against delay and missed connection counts. What type of 
data set is Jim producing? 


A. Metric 
B. Variance 
C. Baseline 
D. Smoothing 
3. Elaine works in IT security and is reviewing user count policies. She needs to strengthen 
passwords by enforcing a mandatory minimum of a nondictionary word that is six or more 


characters in length, contains at least one uppercase letter, and contains a special character. 
What is she defining? 


Federation policy 


A. Object access 
B. User policy 
C. Complexity 
D. SSO 

E. 

F. 


Firewall zone rules 


4. Donald has been tasked by the IT security group in his company to prevent dictionary login 
attacks to the company’s VMs running in a private cloud at a remote data center. You have 
been brought in to offer him advice to deter the random but steady login attacks. What 
would you recommend be enabled to help prevent this type of cyber-attack? 


A. Object 
B. SSO 


Review Questions 239 


Cc. LDAP 

D. Lockout 

E. Access control list 

Christina is configuring her public cloud object storage bucket for granular access from a 


new Linux VM. She wants to set the permissions on the storage system. What would you 
recommend? 


A. Access control list authorization 
B. Federations 


C. Permission-based 
D. SSO 


Liza is reviewing the maintenance responsibilities between her company and its public 
cloud service provider. She notices that the cloud provider takes responsibility for the oper- 
ating system, and she needs to assume responsibility for any applications or services run- 
ning on the operating system. What type of service model is she operating under? 


A. laaS 


B. PaaS 
C. SaaS 
D. XaaS 


Dawn has been working in the NOC and has been tasked with performing a root-cause 
analysis on a recent outage that affected the middle tier web stack in a private cloud. She 
is looking at the log files generated and notices that there are more than 430 logs that were 
generated around the time the site failed. What function does Dawn need to perform to 
distill all of these log files into a meaningful report? 


A. Baseline 

B. Event analysis 

C. Event correlation 

D. Logging 

To increase TipoftheHat.com’s security posture, Allison is reviewing her company’s user 
accounts that access the fleet cloud resources. Allison notices that the summer interns have 
left to go back to school but their accounts are still active. She knows they will return for 


the winter corporate announcements and new products rollouts to assist in the project over 
winter break. What would you suggest Allison do with these accounts? 


Do nothing. 

Delete the accounts. 

Disable the accounts. 

Change the resource access definitions. 


Modify the confederation settings. 
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Change the access control. 


240 


10. 


11. 


12. 


13. 
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To make sure that all users are allowed to access only approved resources, Marie is auditing 
her public cloud identity systems. She wants to control specific access and operations. What 
is Marie defining? 


A. Federated access 

B. Resource access definitions 

C. User permissions 

D. Access control lists 

To promote consistent cloud monitoring and to reduce configuration overhead, Lisa has 
created a number of policies to obtain baseline data. What type of polices is Lisa creating? 
A. Collection 

B. Dissemination 

C. Notification 

D. Publishing 


Matt is preparing for an upcoming promotion his company is offering during a major soc- 
cer game. He needs to determine his options to add capacity to his company’s web server 
farm so it can handle the anticipated additional workload. You are brought in to consult 
with him on his options. What do you recommend as possible solutions? (Choose three.) 


A. Vertical scaling 

B. Horizontal scaling 

C. Edge cache 

D. Cloud bursting 

E. Core elasticity 

Bob is configuring an event notification service and notices that there are many different 
devices and services that can be subscribers to the notification system’s published events 
queue. The notification services offer each event to be sent to a fan-out of multiple devices 


that can act upon the received information. What are examples of the notification server’s 
receivers? (Choose all that apply.) 


Windows OS 
Android 

APIs 

Service queues 
Launch scripts 
All of the above 
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Samantha has been monitoring her cloud web server dashboard and notices that the CPU 
utilization on her company’s database servers has been consistently at more than 80 percent 
utilization. She checked her baselines and reported that 57 percent utilization is normal. 
What is she noticing? 


A. Deviation 


B. Variance 


14. 


15. 


16. 


17. 


18. 
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C. Triggers 
D. Baseline imbalance 
Mindy has a SQL database back end that runs on a multi-CPU instance that has reached 


100 percent utilization. The database supports a single server. What options does she have 
to support the requirements of this database? 


A. Horizontal scaling 

B. Vertical scaling 

C. Pooling 

D. Bursting 

What is the ability to automatically and dynamically add additional resources such as stor- 
age, CPUs, memory, and even servers referred to as? 

A. Bursting 

B. Pooling 

C. Elasticity 

D. Orchestration 

Ethel is the network architect for a hybrid cloud operation and has interconnected her 
private cloud to a community cloud in another province. She is investigating using the com- 


munity cloud to supplement her private cloud operations during end-of-month processing. 
What operation is she going to perform? 


A. Elasticity 

B. Bursting 

C. Vertical-scaling 
D. Autoscaling 


George and Wendy are working together as cloud engineers to combine two like systems 
into one. What type of activity would necessitate this? (Choose two.) 


A. Merger 

B. Acquisition 
C. Divestiture 
D. Bursting 

E. SARBOX 
F. HIPAA 


Allison is preparing to modify a network access control list and add three firewall rules to 
her private cloud HR systems. She is planning on submitting a detailed plan to accomplish 
these tasks. What process is Allison following? 


A. Cloud automation 

B. Change advisory 

C. Change management 
D. Rollout 
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19. What does the application life cycle include? 
A. Deployments 

Upgrades 

Migrations 

Retirements 

None of the above 

All of the above 
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20. Dimitry has been tasked to develop a cross-cloud provider migration plan as part of his 
company’s business continuity plan. As he assesses the feasibility of migrating applications 
from one public cloud provider to another, what does he find is the service model that has 
the most lock-ins and is the most complex to migrate? 


A. IaaS 
B. PaaS 
C. SaaS 
D. XaaS 
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Y 4.5 Given a scenario, analyze deployment results to 
confirm they meet the baseline. 


= Procedures to confirm results 
=» CPU usage 
=» RAM usage 
a Storage utilization 
a Patch versions 
a Network utilization 
a Application version 
a Auditing enable 


a Management tool compliance 


vZ 4.6 Given a specific environment and related data 
(e.g., performance, capacity, trends), apply appropriate 
changes to meet expected criteria. 


= Analyze performance trends 
= Refer to baselines 

= Refer to SLAs 

= Tuning of cloud target objects 


= Compute 





Network 
Storage 


Service/application resources 


Recommend changes to meet expected performance/ 
capacity 


Scale up/down (vertically) 


Scale in/out (horizontally) 


Y 4.7 Given SLA requirements, determine the appropriate 
metrics to report. 


Chargeback/showback models 


Reporting based on company policies 


Reporting based on SLAs 


Dashboard and reporting 


Elasticity usage 
Connectivity 
Latency 

Capacity 

Overall utilization 
Cost 

Incidents 

Health 

System availability 
= Uptime 


= Downtime 


In this chapter, you will learn about the importance of measur- 
“= ing the performance of your cloud deployments and how to go 
BEL about determining what you consider to be a normal operating 
condition. Once a good baseline is determined, then you can track operations and deter- 
mine whether your services are operating beyond your parameters and take corrective ac- 
tions. It is important that you collect actual measurements from your real-world operations 
and not estimate or simulate the baselines. This is done by setting parameters, or metrics, 
on measurable components. These components are called objects, and you can define the 
measurements that are sent to monitoring systems to collect data trends over time. With 
this information at hand, you can have good solid information to base the health of your 
deployment on. 

A cloud service provider outlines their performance metrics in the service level agree- 
ment, and it is your responsibility as a Cloud+ professional to monitor your systems to 
make sure that the SLA performance metrics are being fulfilled. 

Baselines and performance monitoring are also used in capacity planning to determine 
whether you require additional cloud capacity based on usage and consumption informa- 
tion collected over time. For example, as connection counts increase on a web server farm, 
it is important to know if you need to add CPU, memory, or network capacity. With a solid 
baseline and trending data, you can effectively plan to add capacity before you experience 
performance issues. 





Measuring Your Deployment 
Against the Baseline 


To determine whether your cloud services, whether they be servers, storage, security, data- 
bases, load balancers, or any of the other many cloud services offered, are performing as 
expected, you must know what normal is. Let’s start this chapter by setting up your base- 
lines so you can know what is considered to be normal operations and what is out of your 
expectations. 

By following widely recognized best practices for performance measurements, you can 
fine-tune your cloud operations to achieve the performance levels you require to operate 
your business. 
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Object Tracking for Baseline Validation 


When deploying and operating your fleet of cloud servers and services, you will, from 
time to time, encounter performance issues. By identifying and tracking various moni- 
tored statistics from manageable objects, you collect statistical data over a period of time. 
This data will then be used to construct a view of what is considered normal operations. 
These metrics, or baselines, provide valuable historical data of what is considered to be 
normal operations and assist in troubleshooting performance issues. By tracking objects 
over time, the data allows you to compare your current measurements to the baseline to 
see whether there are any deviations in the measurements that could be a cause of perfor- 
mance issues. 

Figure 8.1 shows how a monitoring station collects metrics from objects in the cloud. 


FIGURE 8.1 _ Cloud object tracking 
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When architecting your device tracking to collect data for a baseline and ongoing opera- 
tions, decide what your requirements are. That is, what do you need to measure? If you 
are deploying web servers, for example, then you may want to track VM CPU utilization, 
memory usages, requests per second, and response times from the backend applications. 

It is important that you think this through and measure what you need, but not so much 
that you get flooded with data. Be aware that monitoring adds a processing load on the 
managed devices, so measure only what is needed at appropriate time intervals, such as one 
or five minutes. 

The objective here is to get a detailed and comprehensive collection of data so you can 
document what your performance requirements are. This allows you to scale your cloud 
fleet to the correct size so you do not pay for capacity that is not required or have too little 
capacity that performance or response times suffer. 

Scripts can be utilized on servers that collect the needed data and then store the object 
metrics in a cloud management platform using API calls. Also, most cloud-managed ser- 
vices have object-reporting built into them, and you are allowed to select what you want 
monitored as part of the cloud service offerings. 
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Application Versions 


For proper baseline documentation, it is important that you make valid and meaningful 
comparisons between baselines. Part of this is making sure you track all versioning of ap- 
plications and also operating systems and device drivers if needed. If there are significant 
internal performance differences between application versions, it may render your baselines 
invalid and require that you create a new, or updated, baseline measurement to account for 
the new version of your application. 


CPU Usage 


Many applications are CPU bound, which is to say their performance depends on the 
amount of CPU resources available. One of the most common cloud objects that are tracked 
is the percentage of CPU utilization, as shown in Figure 8.2, since it has a direct impact on 
systems’ performance. This metric is available at the hypervisor level and can automatically 
report usage to management systems with no scripting required. 


FIGURE 8.2 CPU usage reporting 
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CPU usage can be tracked over time to identify trends, peak usage, and any anomalies 
that can provide invaluable information to you for troubleshooting and capacity planning. 


Enabling the Audit Process 


For regulatory or corporate compliance requirements, you may be required to implement an 
ongoing auditing process and retain the data for record retention requirements. This process 
will be specific to the application or cloud provider. In the cloud configuration dashboard, 
most providers will offer as part of their metric-monitoring applications a reporting applica- 
tion that meets the various regulatory requirements they are in compliance with. It is a mat- 
ter of implementing and enabling the auditing feature to meet these requirements. 


Management Tool Compliance 


The cloud providers will offer their own management tools and also make accommoda- 
tions for you to implement your own tools or those of a managed service provider. If there 
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are compliance requirements for the various management tools, they will be outlined in 

the cloud provider’s documentation as to what compliance requirements they meet. If there 
are special requirements for HIPAA, SBOX, PCI, or other industry requirements, it is your 
responsibility to make sure that the chosen management tools meet what is required by these 
regulations. 


Network Utilization 


Congestion across the network can cause major performance degradation. High network uti- 
lization leads to dropped data packets and retransmissions that cause high network latency 
and poor response times. It is important that you consider network infrastructure perfor- 
mance as a critical part of your metrics and benchmark process. 

Network performance measurements are common across all cloud service and deploy- 
ment models and include the following metrics: 


= Capacity: The end-to-end metric for maximum available network bandwidth available 
and utilized capacity, or rate, from source to destination. Capacity is a function of the 
cloud provider’s connections to the Internet and other service providers. While you will 
have little or no control over it, you should track it for SLA compliance and trouble- 
shooting purposes. 


= jitter: The variable delay between packets from source to destination. Excessive jitter 
will cause buffering and unpredictable performance for real-time traffic such as voice 
and video networks. 


= Latency: The time for a packet to travel from source to destination. Latency criticality 
will vary by application with voice and video requiring low latency and e-mail and file 
transfers more tolerant of delays. 


= Packet loss: The percentage or number of packets that are dropped in the network. 
While a certain amount of packet loss is common in Ethernet-based networks, high 
packet loss can cause a noticeable performance impact. Protocols such as UDP do not 
retransmit compared to TCP, which does offer reliable connections by retransmitting 
dropped packets. Packet loss can have a notable effect on video and voice connections 
that rely on real-time communications. There are custom protocols in use that are 
designed for real-time communications that monitor network performance of the video 
or voice streams and adjust accordingly. 


= QOS: Quality of service defines traffic priorities in the event of network congestion or 
impairments. By defining a QOS policy, you can prioritize critical or real-time applica- 
tions over applications that can tolerate network impairments such as delay, dropped 
packets, or jitter. Tracking applications performance can ensure the QOS metrics are 
being honored in the network. 


Patch Versions 


As you learned in Chapter 7, keeping your cloud fleet of services patched to up-to-date ver- 
sions is part of an ongoing cloud maintenance program. Versions are often included in the 
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system’s metadata or can be requested with API calls to the monitored device. VM monitor- 
ing scripts can be created to collect versioning data on the local machine and store it on the 
management server. 

Some cloud providers will offer instances or installable code that allows the VMs to col- 
lect local metrics and download them to a management server. This allows you to collect 
object data such as CPU and RAM utilization as well as look at the OS and even applica- 
tion levels of the server. 


RAM Usage 


When RAM utilization reaches 100 percent on a server, the operating system will begin to 
access the swap file and cause a serious performance slowdown that affects all processes run- 
ning on the server. Monitoring memory usage is one of the most critical objects to monitor 
and collect baseline data on. 

Memory usage should be constantly tracked and measured against the baseline. If mem- 
ory utilization begins to approach the amount of available memory available on the cloud 
server instances, you should immediately take actions to remedy the problem before you 
take a performance hit. 

Adding RAM usually requires migrating to a larger VM instance and the associated 
downtime to perform the migration. The cloud providers offer a wide range of memory 
options to meet any compute requirement. I suggest you allocate more than anticipated 
RAM to your server deployments to reduce the need to perform system upgrades. 


Storage Utilization 


Cloud storage systems offer a wide array of options and features to select from. What is im- 
portant here is that you configure managed objects for storage volumes and their utilization. 
Storage requirements will continue to grow, and by monitoring your storage operations, you 
can allocate additional capacity or migrate stored data to lower lifecycle tiers to take advan- 
tage of lower-cost storage options. 

Another important storage metric is I/O operations. I/O may be a chargeable metric, 
especially for SQL database deployments. Disk read and write objects can be defined and 
tracked as part of your storage system baselines. 


Applying Changes to the Cloud to Meet 
Baseline Requirements 


In this section, you will learn about meeting baselines. As part of your ongoing cloud main- 
tenance plans, you will be tracking your operations against your baselines and adjusting 

or troubleshooting the variations to these trend lines. To keep your operations in range of 
your established baseline, you will be making frequent or infrequent changes to your cloud 
deployments. Some changes may be minor, while others will be disruptive and incur system 
downtime in some cases. 
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Performance Trending 


Once you have your baseline established, you will have solid data for what is considered 

to be normal operations of your cloud servers and services. Using your monitoring applica- 
tion (whether your own it or one is provided by the cloud company), you can now continue 
to collect performance metrics and compare that data against your baseline, as shown in 
Figure 8.3. This comparison will give insight into trends such as incoming connections, CPU 
usage, and any other objects you are tracking. You will be interested to see the increase and 
decrease of usage during hourly, weekly, or monthly time windows. 


FIGURE 8.3. Collecting trending data 
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Trending data is crucial for planning resources to meet future demands. Utilizing trend- 
ing reports, you can see which services may need to be replaced or scaled. This allows you 
to proactively manage your operations and correctly scale services before they become a 
performance bottleneck. 


Baseline Validation 


Is your baseline actually realistic or valid? That can be a critical question as your operations 
will be measured against that benchmark. It better be accurate! 

The best way to validate your baseline measurements is to collect them over a long 
period of time to smooth out isolated events or short-term variations. Also, if it is an 
e-commerce web server, for example, were the measurements taken during the busy holiday 
season or during a slow cycle? 

It may be helpful to compare your baselines against others that are in a similar opera- 
tional state or use case. This can help to validate that your readings are what is expected 
and that there are no outlier measurements. 

Compare and test all metrics collected including CPU, network, memory, storage, and 
any custom metrics with all available data to ensure your readings are in the range you 
would expect them to be in. As time goes on, you will achieve a stable set of operations that 
can be used to establish an accurate baseline. 
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Testing your deployment using simulations of load and application utilization can pro- 
vide initial data on utilization rates to establish an initial baseline. After the testing runs, 
you can evaluate the data, make changes to any performance bottlenecks, and rerun the 
tests to validate the changes made. 

After a system has been patched or upgraded, it is a best practice to run another valida- 
tion to make sure the post-upgrade performance metrics meet your baseline measurements. 

The best way to effectively measure and document a baseline validation during a system 
update or modification is to perform three benchmark validation tests. 


= Pre-patch/pre-upgrade to get a snapshot of current baseline data 
= Post-patch/post-upgrade to get performance data of the systems after modifications 


=» A comparison operation that measures the deltas between the pre- and post-reports 


Service Level Agreement Attainment 


As discussed in Chapter 2, the SLA defines key performance indicators that are the metrics 
selected to determine fulfillment of cloud provider performance guarantees. 

Objects to be tracked should align with the SLA metrics. By collecting actual data, you 
can compare it to the offered service levels outlined in the SLA and ensure that the guaran- 
teed metrics are being met. 

It is up to the cloud customer to track the SLA metrics to ensure the guarantees are being 
met by the service provider. Effective monitoring allows you to accomplish this. However, 
just collecting large amounts of data is not sufficient; you must make sense of the raw data. 
Cloud management applications can process the collected data and present it in graphs and 
tables that make it easy to see the collected statistics in an easy-to-interpret format. The 
management applications can also export the data in Excel format and PDF reports. 

As your business objectives change over time, it will become necessary to renegotiate 
SLA metrics that meet your new requirements. As part of your ongoing management pro- 
cesses, it is important to review the SLA on a regular schedule to make sure the SLA meets 
your operational requirements. 

Review your baselines on a regular schedule and compare them to your SLA. Are they in 
alignment, and do they meet your current requirements? Are there critical metrics that are 
missing? Based on this information, you can discuss your new SLA requirements with the 
cloud service provider and add, remove, or adjust as needed for your current needs. 

Once the new SLA has been agreed to and has taken effect, you can adjust your moni- 
toring systems to measure compliance and alert you to trends or issues that do not align 
with the new agreement. 


Compute Tuning 


Should there be CPU starvation, you can be assured that your deviation from the baseline 
will be very noticeable! The only available solution is to either lower the load on the instance 
CPUs or add additional computing resources. Operating systems offer utilities that show 
how much CPU resources different processes are using. If possible, you can disable or shut 
down any services that are using up CPU cycles that are not needed. 
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If you are in the situation where you have tuned your server for optimal CPU resource 
consumptions and still are suffering from high CPU usage, then you may have no other 
choice but to upgrade your instance either vertically or horizontally to add CPU power. 
This will involve replacing your current machine image with that of a larger offering 
that has additional CPU capacity. Additional capacity can be added by either imple- 
menting a higher-performance CPU with higher clock speeds and a newer architecture 
or by converting to an image with multiple cores. This is known as vertical scaling. 
Performing vertical migration will involve some downtime to make the conversion. 
However, with the virtualization capabilities of the cloud, you can spin up a new, and 
larger, service instance; install and test your application; and have it validated before 
you go live with the new image and shut down the older image. The second option is to 
keep your existing deployment and add to it by implementing more servers of a similar 
architecture that run in parallel. This is referred to as horizontal scaling and will be cov- 
ered later in this chapter. 


Network Changes 


When making deployment changes to networking performance issues, you need to under- 
stand what you can control and what the cloud service provider controls. Many of the 
networking parameters are global to the cloud and out of your area of authority. However, it 
is important to understand that making sure the network performs inside your baseline and 
SLA is your responsibility. 

Cloud companies do offer solutions for network-intensive requirements. These include 
server images with 10 Gbps network adapters, a low-latency interconnection that places all 
of your servers on the same hypervisor for high-speed, low-latency interconnections, and 
the ability to group all of the servers in the same zone and subnet. 


Storage Tuning 


Baselines can be used to ensure that the storage systems meet your performance require- 
ments and allow you to track changes over time. Storage systems are often monitored for 
I/O utilization from the host bus adapter to the SAN. Should there be excessive utilization, 
disk read/write performance will suffer, and the application’s performance will degrade. The 
solution is to increase the bandwidth of the adapter on the VM. Using metrics that define 
what will be considered to be high utilization of storage network bandwidth over a defined 
period of time, automated actions can be performed to remedy the issue, or you can upgrade 
your machine image to one that is optimized for storage operations. 

The monitoring system will receive and monitor log information from the VM, and 
for example, if disk I/O exceeds 80 percent utilization for a three-minute period, an 
autoscaling event will increase storage adapter bandwidth. When the utilization drops 
below your defined threshold, the bandwidth can be scaled back to its original value to 
save on costs. 

A related issue is database read/write replicas. If a database is highly utilized, a sin- 
gle database replica may be bandwidth-starved and become a performance bottleneck. 
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This can be resolved by creating multiple read replicas on different storage volumes and 
balancing the server access across these replicas to distribute the load on the storage 
systems. 


Service/Application Changes 


Changing or upgrading services and applications may be required to add new capabilities 
and features that are beneficial or to maintain your cloud deployment compliance with 
changing regulations or corporate policy. 

If you are implementing a SaaS solution, then the cloud provider will be responsible for 
any changes made to the application. They will most often notify you that a change is being 
made in the form of an update announcing new features or a maintenance upgrade that 
will be implemented. Cloud providers are constantly upgrading applications such as data- 
base offerings and collaboration services, for example, and this is a benefit to you as you 
can take advantage of the new features and capabilities offered. 

Services such as load balancers, firewalls, DNS, identity management, and virtual pri- 
vate clouds also undergo frequent upgrades to keep pace with the competition and to add 
features. These services are largely the responsibility of the cloud provider and to your ben- 
efit as you get to take advantage of the new capabilities and offerings with little effort on 
your part. 


Changing Operations to Meet Expected 
Performance/Capacity Requirements 


As your cloud operations grow and evolve, so may your requirements for additional capacity 
and higher levels of performance. This will mean that you will be making changes to your 
deployment over time to meet your current and future capacity needs. In this section, you 
will revisit scaling and add details to the process now that you have a good understanding of 
monitoring and baseline management. 


Vertical Scaling 


You learned about vertical scaling in Chapter 7. In this section, the topic will be expanded 
upon, and you will learn the process to vertically scale your server to meet expanded 
workloads. 

Some applications, such as many types of databases, are not designed to scale horizon- 
tally. You will need to scale to a larger machine image to increase resources for the appli- 
cation, as shown in Figure 8.4. The solution here is to configure monitoring metrics for 
critical server resources such as memory, storage, network and storage I/O and CPU. As 
you learned, these metrics can be collected and analyzed by monitoring applications and 
triggers configured to scale the virtual machine to a large instance type to handle the pre- 
sented workloads. 
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FIGURE 8.4 _ Vertical scaling 
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Existing Server Replaced by a 
Larger Capacity Server 


When the scaling occurs, the existing machine is replaced with a larger instance type 
that you define. Depending on your requirements, you may add additional CPUs, memory, 
network bandwidth for storage, or LAN traffic. Be aware that you will effectively be 
replacing servers, so there will be downtime. This can be automated for dynamic scaling or 
performed in a maintenance window. With accurate benchmarks, you can see the trending 
data and scale before there are any performance issues. When the new server replaces the 
older image, the IP address will move to the new machine so that any DNS records of appli- 
cation settings do not have to be modified. Other operations involved in vertical scaling 
will be to mount storage volumes, put the new server image in the same security group, and 
assign user access rights to it to match the server being replaced. 

As a general rule, you do not want to perform vertical scaling operations on a regular 
basis. The operations should be reserved for when it is absolutely required and you plan on 
staying on that instance for a long period of time. This is because of the disruptive nature 
of the upgrade. 


Horizontal Scaling 


Horizontal scaling is the process of adding cloud capacity by expanding your current server 
fleet by adding systems, compared to vertical scaling, which is replacing servers with a larger 
instance that meets your new requirements. Horizontal scaling works well for applications 
that are designed to work in parallel such as web servers, as shown in Figure 8.5. You keep 
your existing server instances and add more to increase capacity. 


FIGURE 8.5 Horizontal scaling 
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Existing Servers Horizontally Scaled Servers 





A common way to automate adding machines to your operations is to configure the 
management application to monitor key metrics and respond when they are deviating from 
your baseline. For example, a fleet of web servers can be monitored for CPU utilization, 
and if they all exceed 80 percent over a five-minute window, you can trigger an autoscaling 
event. The monitoring application will initiate the loading and configuring of predefined 
web server images. You can define the number of VMs and configuration of the added 
capacity you require. The automation application will also add the new machines to a load 
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balancer group, or DNS if needed, and put them into service. You can set up alerting to be 
notified of the event for awareness. 

The autoscaling service can also be configured to remove the servers after the load has 
fallen below your defined metrics for a period of time to eliminate charges for unused 
capacity. Additional features offered are the ability to statically define time windows to add 
and remove capacity and to make sure that your server fleet maintains a minimum number 
of servers. If a server should fail for whatever reason, the autoscaling service can replace it 
with another. 


Cloud Accounting, Chargeback, and Reporting 


Cloud management includes accounting mechanisms for measuring consumption, billing, 
and generating management reports. In this section, you will learn about these nontechnical 
but important aspects of cloud operational management. 


Company Policy Reporting 

Companies will publish and manage IT polices; these policies cover a wide range of subjects 
including, but not limited to, how cloud services are consumed and accounted for. To effec- 

tively measure compliance, you will need to collect the required data and be able to process 
the information into effective reports. 

Cloud providers are aware of policy reporting and offer services to assist you in collect- 
ing and presenting reports. These services are cloud-based and can be remarkably custom- 
izable. They are presented in a graphical format in a web browser dashboard. Also, the 
reports can be exported to Excel or PDF format, as shown in Figure 8.6. 


FIGURE 8.6 Cloud reporting 
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Reporting Based on SLA-Based Reports 


As you have learned throughout this chapter, there is a close relationship between collecting 
data into baselines and then measuring them against your SLA to ensure compliance. Man- 
agement services allow you to compare these two metrics and generate reports that can be 
used to analyze trends, identify problems, and store data for regulatory or corporate compli- 
ance purposes. These reports can be exported as discussed earlier, in many different formats 
including Excel and PDF documents. 
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Using the Cloud Dashboard 


Cloud dashboards are incredibly useful and informative. It is common to display dashboards 
in operations centers or overhead in office environments to give an easy-to-read overview 

of operations. Dashboards are usually graphical and color-coded for quick notification of 
potential issues. 

Dashboards are offered by the cloud providers, your internal monitoring and man- 
agement applications, and any outside monitoring services you have contracted with. 
They allow you to define what you want to display and in what format. Dashboards 
are completely customizable and rather easy to configure. Once the dashboard has 
been defined, users with access rights can easily access them with a standard web 
browser. 


Elasticity Usage 


As you learned earlier in this chapter, one of the great benefits cloud computing offers is elas- 
ticity and the flexibility automation offers in adding and removing capacity. Elasticity events 
often incur charges and are also important to monitor to ensure that your cloud operations 
are scaled correctly. 

Management applications can generate usage reports on a large number of events includ- 
ing elasticity. Metrics such as the event time and duration are recorded as well as details of 
the added capacity and utilization metrics that were collected after the scale-up or scale- 
down events occurred. Also, comparisons to performance and SLAs are important reports 
to generate to meet compliance with regulatory needs. 

As with the other reporting types, you can generate the reports in formats that meet 
your needs. 


Connectivity 


Corporate management and various departments in your company will always be interested 
in how their operations are being accessed and who is connecting to their cloud presence. 

Reports and graphical presentations can be created to show connections over time, 
location, new or returning visitors, what was performed (did they buy anything on your 
e-commerce site?), and how long they were visiting. This is valuable data for sales, market- 
ing, and accounting. 


Latency 


Network delays and slowdowns can have an extremely negative effect on cloud operations. 
If an e-commerce site has high latency, many potential customers may give up and leave, 
causing lost revenue. Companies that rely on cloud-based services such as e-mail, databases, 
or any of the other many benefits of cloud computing will suffer productivity declines as 
they sit and stare at a screen that is not responding. 

Latency in the network can come from many different sources; however, individual 
cloud bottlenecks all add up to latency, and the end result is frustrated employees and 
customers. 
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Metrics, benchmarks, SLAs, and proactive maintenance all come together to keep 
latency low and performance high. 

Naturally companies want to track and report on how the cloud is performing, and 
latency is the big picture of performance. Reports can show latency globally and drill down 
to individual services such as a web server’s response and database read-write latency. 


Capacity and Utilization 


Capacity and utilization reporting can include a wide range of metrics including storage, 
CPU, RAM, network, and so on. These reports are helpful in managing usage trends and 
change requirements. Accounting will be interested to see that the capacity purchased is be- 
ing used effectively. As with the other measurements, capacity reports are customizable and 
offered in a variety of formats. 


Incident and Health Reports 


Tracking support services and impairments will give you insight into the overall reliability of 
operations, and the collected data can be compared to your SLA to ensure compliance. 

Incidents can be defined by your company or the cloud provider as required. Incidents 
and health reports include trouble tickets opened, support engagements, and any event that 
causes degradation of your services. 


Uptime and Downtime Reporting 


A critical and bottom-line metric of any SLA is that of downtime. If you cannot access your 
cloud deployment, that is a critical event and must be tracked. Both the cloud provider and 
your operations center should track downtime and identify the root cause of what caused 
the outage. These reports can be analyzed to ensure SLA metrics are being met and to see if 
you have to change your architecture to design for higher reliability and less downtime. 


Summary 


This chapter focused on managing your cloud operations by establishing effective baselines, 
measuring performance, and understanding the importance of SLAs. 

Baselines are created to establish what reporting is considered to be normal operations. 
By measuring critical components and utilization, data sets can be created and measured 
over time to determine how your cloud components are being used. With a well-established 
baseline, variations can be highlighted and used for identifying problems, the need to add 
capacity, if SLAs are being honored, and usage trends. 

Baselines are a collection of metrics that are gathered from cloud objects such as CPU, 
RAM, storage, network, and any other service or component you deem important to mea- 
sure. Baselines are a point-in-time view of operations and need to be constantly tracked as 
part of your ongoing operations. Baseline data allows you to analyze how your operations 
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are performing, plan for growth, and generate reports for regularity or corporate compli- 
ance requirements. 

The process of adding capacity by using cloud elasticity functions was introduced, and 
details were provided on autoscaling your deployments. Vertical scaling was expanded 
upon and is replacing a server with a larger, more capable system. Horizontal scaling takes 
a different approach and adds additional servers to your existing fleet for added capacity. 

The importance of the service level agreements was introduced, and you learned about 
collecting operational data to measure SLA compliance. SLAs may need to be adjusted as 
your business needs evolve, and baselines may need to be modified to track new metrics 
included in the SLA. 

Generating reports is an ongoing process for a Cloud+ certified professional. Reports are 
used to show utilization, capacity, billing, SLA attainment, latency, incidents, and availabil- 
ity. Reporting is flexible with the management applications offered by cloud service provid- 
ers and monitoring companies. They are highly customizable and can be tailored for your 
internal corporate audiences and for regulatory or compliance needs. 

Dashboards are visual reporting of cloud objects and services. A dashboard can be 
created to display graphs and charts of what you deem to be important. Dashboards are 
often displayed in network operations centers and user browsers to display real-time cloud 
statistics. 


Exam Essentials 


Know what baselines are and how they are created. For the exam you may be given long 
scenario questions that pertain to measuring a system to determine its normal operational 
state, or the process of monitoring objects such as CPU utilization, and you must be able to 
identify that the question concerns baselines. 


Understand service level agreements and what their purpose is. SLAs are service provider 
documents that outline detailed performance metrics the provider guarantees to meet for 
their customers. Items such as downtime, latency, compliance, and division of responsibilities 
are all included. The exam may detail what is included, and you will be required to identify 
that it is the SLA that is being referred to in the question. 


Know what objects and metrics are. Objects are anything that can be measured and have 
data collected on. Metrics are the actual data. You may be given a long scenario question 
that, for example, asks about a performance issue of a server and how data can be collected 
and analyzed to determine what the problem is. 


Differentiate between reporting options. For the exam, know that there are many different 
types of reporting options available for management, marketing, accounting, and operations. 
Know that these may include policies, SLA attainment, elasticity, connectivity, latency, capac- 
ity and utilization, cost accounting, incidents, and availability. You may be asked to identify 
which reporting is being discussed in an exam question. 
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Understand the different ways to add capacity. Given a scenario, you may be asked to iden- 
tify a performance issue and determine what steps to take to remediate the problem. Know 
that scaling can be automated and that vertical scaling is expanding the capacity of a server 
and that horizontal scaling is adding servers to your fleet. Read each question carefully to 
fully understand what the performance issue is and the application requirements to be able 
to identify if vertical or horizontal scaling is the correct solution. 


Written Lab 


Fill in the blanks for the questions provided in the written lab. You can find the answers to 
the written labs in Appendix B. 


On D A UNa 


10. 


The ________ measurements are used to detail resource usage under normal operations. 
A________ is data collected from an object. 
Cloud components that data can be gathered from are referred to as 
scaling is adding capacity by deploying additional servers. 
Reducing swap file usage can be accomplished by adding additional 
Network delays and slowdowns are an indication of high network 
The ability of cloud resources to scale up and down is referred to as 


The service provider outlines their performance guarantees in a 


a: is the process of replacing a single machine image with a larger, 
more powerful image. 


For regulatory or corporate compliance requirements, you may be required to 
implement an ongoing _________ process and retain the data for record retention 
requirements. 
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Review Questions 


The following questions are designed to test your understanding of this chapter’s material. 
For more information on how to obtain additional questions, please see this book’s 
Introduction. You can find the answers in Appendix A. 


1. When monitoring performance metrics on one of your servers, you notice that the server 
is utilizing 100 percent of the network bandwidth available to it. What modification could 
you make to the server that will most likely address the problem? 


A. Add memory to the system. 
B. Install a second network adapter. 
C. Update the network adapter’s firmware. 
D. Install a second processor. 
2. Which of the following is not a statistic that you would typically find in a server 
performance baseline? 
CPU utilization 
Disk transfer rate 


A 
B 
C. Network transmissions speed 
D. OS update history 

E 


Memory utilization 
3. What type of scaling involves replacing an existing server with another that has more 
capabilities? 
Horizontal 
Round-robin 


A 

B 

C. Elasticity 
D. Autoscale 
E 


Vertical 


4. Incident reports include which of the following? (Choose three.) 
Trouble tickets 

SLAs 

Scaling 


Support engagements 


mo oP 


Outages 


5. Databases capacity can be added by scaling horizontally. 
A. True 
B. False 


10. 


11. 
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Cloud provider SLAs outline which of the following? (Choose two.) 
Device configuration 
DNS configurations 


A 

B 

C. Uptime 
D. Network performance 
E 


Autocache 


Reports are often provided to which interested parties? (Choose four.) 
Marketing 

Management 

Cloud provider operations 

Accounting 


Internal operation centers 


™moOO BD 


Customers 


To collect metrics, you set up your management application to measure what? 
A. Database 

B. Server 

C. Hypervisor 

D. Objects 


Reports are generated where? 
A. Hypervisor 

B. Databases 

C. Logging servers 


D. Cloud management and monitoring application 


What is a visual representation of your current cloud operations? 
A. Operational matrix 

B. Management console 

C. Dashboard 


Upgrading to a newer operating system may require that you update what? 
A. SLA 

B. DNS 
C. Baseline 
D. VPC 
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12. 


13. 


14. 


15. 


16. 
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Capacity and utilization reporting often contains data on which of the following objects? 
(Choose three.) 


A. CPU 

B. OS version 
C. Volume tier 
D. RAM 

E. Network 


Autoscaling can be configured to which of the following? (Choose four.) 


A. Add capacity. 

B. Configure time-of-day capacity. 

C. Generate metric reports. 

D. Remove capacity. 

E. Maintain a minimum number of servers. 
F. Track SLA objects. 

G. Perform patch management. 
Cloud-based reports can be generated in which formats? (Choose two.) 
A. SQL 

B. PDF 

C. Python 

D. JSON 

E. Excel 


What type of scaling involves adding servers to a pool? 


A. Horizontal 
B. Round-robin 
C. Elasticity 

D. Autoscale 

E. Vertical 


Carl has noticed a slowdown in the response times of his SQL database and has been tasked 
to investigate the root cause of the delays. He has decided to configure his monitoring 
application to gather additional data on what may be the cause of the delays. What are 
some of the objects you would recommend he collect data on? (Choose three.) 


Read replica I/O 

Load balancer latency 
CPU 

Network packet drops 
Machine image 

SLA 


™moOoO WD 
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17. Object tracking can be helpful in identifying which of the following? (Choose three.) 
A. Resiliency 


B. Trends 

C. Metrics 

D. ACLs 

E. Peak usage 
F. Anomalies 


18. Rebecca is writing a change management plan to increase the processing abilities of one of 
her middleware servers. What components can she upgrade to increase server performance? 
(Choose three.) 


A. CPU 
SLA 
Cc. RAM 
D. Network I/O 
E. ACL 
F. DNS 


19. Object tracking should be aligned with which of the following? 


A. VPC 
B. SLA 
C. RDP 
D. JSON 


20. High-performance network clusters should share which the following? (Choose two.) 
A. Availability zone 
B. Group cache 
C. Identity group 
D 


Hypervisor 
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THE FOLLOWING COMPTIA CLOUD+ EXAM 
OBJECTIVES ARE COVERED IN THIS 
CHAPTER: 





= | < 514 Given a scenario, troubleshoot a deployment issue. 





= Common issues in the deployments 
= Breakdowns in the workflow 
= Integration issues related to different cloud platforms 
=» Resource contention 
= Connectivity issues 
= Cloud service provider outage 
= Licensing issues 
= Template misconfiguration 
= Time synchronization issues 
= Language support 


=» Automation issues 


¥Y 5.2 Given a scenario, troubleshoot common capacity 
issues. 


=» Exceeded cloud capacity boundaries 
= Compute 
=» Storage 
=» Networking 
= IP address limitations 
= Bandwidth limitations 
= Licensing 
= Variance in number of users 
= API request limit 
= Batch job scheduling issues 
= Deviation from original baseline 


= Unplanned expansions 








Z 5.3 Given a scenario, troubleshoot automation/ 
orchestration issues. 


= Breakdowns in the workflow 
=» Account mismatch issues 
=» Change management failure 
=» Server name changes 
= IP address changes 
= Location changes 
= Version/feature mismatch 
=» Automation tool incompatibility 


= Job validation issue 





Cloud computing can be complex! As you have learned 

“= throughout this study guide, there are a lot of different compo- 
BEL: nents and advanced technologies that make up the cloud. It is 
not uncommon to see a public cloud provider offering more than 100 different services. The 
combinations of all these offerings are practically limitless. With this flexibility and sophisti- 
cation comes the reality that there are a lot of things that can go wrong. Not only can there 
be problems, there often are. 

When your cloud deployment fails or is not operating as it should, your ability to 
troubleshoot and resolve issues will be called upon. The process of investigating and deter- 
mining what the underlying problem is, and then resolving, is part art and part science. By 
understanding the details of your operations, referring to the proper documentation, and 
knowing how to use the tools and applications at your disposal, you can effectively trouble- 
shoot and resolve any issues that you will encounter. 

The objectives in this chapter cover common issues that, as a Cloud+ professional, you 
will be most likely to encounter. Complete books can be written on resolving problems 
with these services. However, for this exam, you will be introduced to the various issues 
you may encounter and then be expected to identify them in scenario-based exam ques- 
tions. This chapter builds on the knowledge you have accumulated throughout this book, 
so knowledge of the many cloud services is expected before learning how to troubleshoot. 





Examining Common Cloud Issues 


While cloud issues can appear to be specific to one service, they can span across many dif- 
ferent components and services in the cloud. In an effort to create some structure to trouble- 
shooting, we have grouped some of the more common issues in this section. These broad 
categories act as pointers, or hints, to where a problem may reside. Also, when troubleshoot- 
ing, eliminating these categories as the issue can help lead you to the issue. 


Automation 


What could possibly go wrong with a fully automated system where just the click of an icon 
unleashes a host of cloud automation scripts? Well, many things can go wrong! Not only 
that, automation often hides the complexity from the user and does not always report results 
to the person using these automated services. 
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The ability to troubleshoot automation-related problems comes down to whether you 
control the process or another party such as the cloud provider does. If the automated sys- 
tems are part of the backend virtualization services embedded in the cloud provider’s oper- 
ations, then it is beyond your reach to troubleshoot the actual issue. However, when using 
these services, it is critical that you validate the end result is what you expect. Look at your 
original deployment plan and what you actually configured in the deployment and compare 
that to what you see as running services. If there is a discrepancy, go back and make sure 
that you requested what was actually deployed. Is there a difference between the input and 
the output? If the input, or requested, configuration is what you expect but the deployed 
services are different, it could very well be that the automation software did not work as 
expected. Log files can be collected on all API calls to a device or service; these can offer 
valuable information on the success or failure of the scripts used. A well-written script can 
also validate the changes and roll back if there was a script failure. Monitoring dashboards 
can also be configured to monitor the results of the automated systems in a graphical man- 
ner. Since it is most likely that you do not have access to the underlying automation code, 
your only real option here is to open a trouble ticket with the cloud provider for investiga- 
tion. Also, the frequently asked questions (FAQ) or support discussion forums may have 
additional information on the issue you are troubleshooting. 

If it was your organization that developed the automation applications, then you will 
have much greater flexibility in troubleshooting. Are there log files that were generated? Did 
the script fail before completion? Did an API call fail? By investigating the software and 
stepping through its execution, you, or your development team, should be able to identify 
the issue internally to your organization. 


Cloud Interoperability 


Interoperability between clouds, whether they be public, private, hybrid, or community, can 
expose a wide variety of issues that can trigger many hours of troubleshooting! 

Cloud interoperability issues should be well investigated by the architect teams prior to 
deployment. Cloud provider documentation and testing often provide best practices and 
validated configurations. There are many vendor papers published with best practices for 
interoperability. The support forums can be invaluable as you may find discussions from 
other groups that are experiencing the same problems as you are and the results of other’s 
troubleshooting. Also, the cloud companies often monitor or moderate these forums and 
can offer solutions to the issue you are experiencing. A good search engine and service pro- 
vider documentation will go a long way in resolving cloud interoperability issues. Search 
for validated or reference designs that detail tested configurations and compare them to 
your deployment. 

As much as possible, you should investigate where the source of the issue is located. 
This can be done by investigating log files and monitoring systems. Effective dashboards 
will also be a huge help here. Once you have a good idea of where the problem is located, 
you can localize your investigation to that cloud provider. For example, if you are want- 
ing to move a virtual machine image from one cloud provider to another, all restrictions 
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and caveats need to be identified to determine whether there are any interoperability 
issues you may run into. To troubleshoot issues like this, investigate the possibility of 
changing the format of the image at the source when you create it to match the destina- 
tion or to see whether there are image conversions or import services offered by the 
destination provider. 


Interconnections 


Your connections to the cloud can test your networking troubleshooting skills. Most cloud 
providers offer VPN connections from your offices or data centers to their cloud data 
centers. These connections may drop and not reestablish or experience errors that cause 
retransmissions that degrade response times. The VPN console from the cloud company 
and the VPN system at your location can be investigated for status and log information that 
often points to the problem. 

If the interconnection problems reside inside the cloud provider’s infrastructure, such as 
connections between availability zones or regions, then you must rely on the cloud provider 
to resolve the issue. Cloud providers commonly post a health monitoring dashboard that 
offers a visual representation of any current problems they are experiencing. 

Common interconnection issues are the encryption transforms matching. Are the secu- 
rity configurations the same on both ends of the VPN? Also, verify that your security 
certificates have not expired and that the link maximum transmission unit (MTU) is large 
enough to not cause fragmentation of network packets. 


Language Support 


This one can be a bit confusing; to clear it up, it is what programming languages are 
supported in your cloud services. This is more of a compatibility issue than anything 
else. The cloud provider will publish what it supports, and you must interoperate in 
that language. 

Cloud automation and configurations generally support JSON, Python, and XML. 
Providers will publish this information online either in their technical documentation or in 
their FAQs. Pay special attention to any version requirements and ensure that you match 
what is supported. 


Licensing 


Licensing issues often manifest themselves as a sudden failure after everything has been 
working fine all year. After a quick investigation, you see in the log files that the application’s 
license has expired! 

The service model will determine how to start troubleshooting a licensing issue. As 
you learned, the IaaS and PaaS models allow you to install and run your own applica- 
tions. Since you own the application, you are responsible for the licensing that allows you 
to use it. 
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With SaaS, the cloud provider is responsible for the application, and you pay for its use. 
As such, the SaaS provider is responsible for the software license, so the provider will man- 
age all licensing-related issues. 

You did follow best practices and document how licensing is managed between your 
company and your application vendor, right? This will be extremely handy when trouble- 
shooting licensing-related outages. There can be a remarkable level of complexity when 
licensing application software. The vendors offer a bewildering number of options, and no 
two companies are alike. Software licenses for cloud deployments may be different than 
the structure for the same application running in your private data center. One may base 
its license on the total number of users, named users, or concurrent connections. It is com- 
mon to find licenses for each processor that is used or the number of cores. There is more, 
licenses can also be based on actual usage measured by object monitoring. 

License capacity can be measured in many ways, such as the number of users, total 
connections, named users, concurrent connections, or usage metrics. The license capacity 
responsibility is dependent on the service model. If it is an IaaS or PaaS model, you will 
most likely be responsible for the licensing, and if it is a SaaS model, the cloud service 
provider will take care of all licensing issues. 

The bottom line is that you should track license consumption and keep ahead of capacity 
requirements. 

Security certificates, while not specifically licensing, also expire. This can be a cata- 
strophic event because any service, such as HTTPS, VPNs, storage, and communication 
encryptions and authentication systems that rely on the certificate, will also fail. Keep track 
of all certificate expiration dates and renew them prior to expiration! 


Networking 


Networking issues were introduced in the “Interconnections” section. To expand on 
network-specific issues, you need to store your log files in a syslog server so that you can 
compare information across multiple network devices. Cloud dashboards or in-house 
management or monitoring systems collect networking object metrics and are invaluable in 
reporting network problems. 

Troubleshooting networking issues can be from either the ground up or the top down. 
A ground-up approach starts with the link-level statistics. Are there errors on the link? Is 
the link “up” and communicating with the remote device? Check networking operations 
as you move up the OSI stack from the physical layer to data-link, network, transport, and 
above. Check routing tables to see whether there is a path to the remote network. ping is a 
common troubleshooting utility, which you can use to see whether the remote is reachable. 
Another is traceroute, which follows a packet through the network from its source to the 
destination and can point to failures along the way. Check any access control lists or fire- 
wall rules that may be blocking traffic that you want to allow. 

If you troubleshoot from the top down, you will start at the application and make sure 
that it is operational and able to communicate with the network stack. Work your way 
down from here until you verify that the data is reaching the network and being transmit- 
ted or whether there is a failure in the network stack. 
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Resource Contention and Starvation 


As you learned in Chapter 8, a good baseline needs to be established so that you have 
solid data on what is normal. Once you have data on what is considered to be normal, 
you can monitor to see whether there are any issues with current measurements such as 
contention for resources. As your cloud activity grows, you may, at some point, run out 
of system resources. A resource starvation issue will usually manifest itself as a slowdown 
in performance as the application contends for what has now become a scarce resource. 

Resource contention is conflicting access to resources such as CPU, network bandwidth, 
random access memory or storage. This leads to resource starvation where services are 
denied access to these pools. 

To troubleshoot limited resource problems, it is helpful that you have set up object moni- 
toring on critical systems and display the metrics on a dashboard. Also, thresholds can be 
programmed to trigger alarms when, for example, CPU utilization exceeds 90 percent for 
five minutes. 

Common resources that may saturate over time are CPU, memory, storage, storage net- 
work bandwidth, and network capacity. 

To resolve contention and starvation issues, it usually comes down to throttling the sys- 
tem consuming the resource or having to add capacity. If you add capacity, you can decide 
to use autoscaling to dynamically add or subtract resources based on current load or to 
manually upgrade virtualized resources for greater capacity. 


Service Outages 


If there is a service outage, you will certainly be in for some excitement! If the outage is in 
your network, it needs to be localized and all necessary resources brought in to resolve the 
issue. Companies often establish a “war room” where all the different groups that can assist 
in resolving the issue can congregate and collaborate to resolve the issue. War rooms may 
also have video, audio, and collaboration links with overhead displays to assist in trouble- 
shooting. A service outage can include many different parts of your deployment, so you must 
be able to call in the groups or individuals who are responsible at a moment’s notice. A good 
corporate response plan is needed in these cases. 

Service outages can come from a wide variety of sources, some that are under your 
control and many that are not. If there is a power or carrier outage, you must rely on 
them to restore services. Storms or natural disasters can cause outages that may take 
time to restore. A good disaster recovery plan is essential because you may have to 
decide to fail over to your backup site if the outage is expected to last for an extended 
period of time. 

Outages in the cloud are rare but certainly not uncommon. Public clouds are designed to 
be highly resilient to individual device failures. With the popular availability zone architec- 
ture, should an availability zone fail in a cloud region, the applications can be designed to 
automatically fail over to the backup availability zone with a minimal loss of service. 

Cloud providers, as discussed, have extensive reporting systems that publicly dis- 
close network heath and any availability issues in their network that they are currently 
experiencing. 
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Templates 


Templates are software representations of network systems. By using these templates, you 
can deploy complete cloud systems at a single time. This allows you to implement “one-click 
provisioning” instead of deploying and configuring individual cloud objects. Templates can 
be helpful with automated deployments of virtualized systems. The template may use API 
calls to cloud services that have changed over time. It is a best practice to validate that your 
templates are current and operational so as to prevent them from failing when they are most 
needed. 


Time Synchronization 


Cloud services are often global in nature, which is to say resources can be in many different 
time zones. It is desirable to collect logging (syslog) information in a central server for all of 
your cloud objects. What happens if your devices all timestamp logging data in their local 
time zones? It’s a huge mess. 

The Network Time Protocol (NTP) allows all devices to synchronize to a central clock 
or time service. This ensures that all devices report the same times to allow for synchro- 
nization of logging information. It is important that you verify regularly that your cloud 
elements are synchronized with the NTP servers to prevent the drifting of device clocks. 
Cloud elements will have a command line, API, or GUI interface that shows if there is time 
synchronization. 


Workflow 


Workflow services will often be a collaboration of many applications coordinated by a 
workflow application running in the cloud. Workflow applications track a process from start 
to finish and sequence the applications that are required to complete the process. There will 
be a management console for the cloud-based workflow applications that are offered under 
the Software as a Service model. You can track individual jobs and see where they are in 

the workflow process and whether there are any errors. Based on this information, you can 
troubleshoot or restart the workflow. 


Troubleshooting Cloud Capacity Issues 


In this section on troubleshooting, you will learn about the limitations of the various cloud 
services, how to identify them, and what options are available to troubleshoot and resolve 
these types of issues. 

Any system, whether it be hardware or software, will have a limit to its ability to handle 
a workload. This is its capacity, which can be defined as the maximum amount that some- 
thing can contain, or in the case of cloud resources, the maximum limit of any object or 
service that is supported. 
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Cloud capacity planning was covered in the previous chapter and is the process of moni- 
toring your operations and adding resources prior to them becoming exhausted. If you do 
not plan and add resources in a proactive manner, then you will, at some point, run into 
resource starvation and performance issues. You will learn about the more common prob- 
lems you may find and how to troubleshoot them. 


Capacity Boundaries in the Cloud 


Every device or service will have a maximum threshold that, when exceeded, will fail, drop 
the requests, or slow down. Systems can, and do, get overloaded and often produce unpre- 
dictable results. 

It is acommon practice for cloud providers to publish the performance statistics of their 
services that also include maximum supported metrics. 

A good baseline will show you your current capacity consumption and allow you to 
compare that to the maximum available. With this information, you can make informed 
decisions on managing your cloud operations. 

You may have agreements with the cloud provider on the capacity level you have pur- 
chased and included in your Service Level Agreement (SLA). Should you approach the 
contracted capacity level, you can often purchase additional capacity and avoid any perfor- 
mance issues. 


API Request Capacity 


Application program interface (API) requests are usually a metered resource in the cloud. 
You will be charged for the total number of requests over time and have a maximum avail- 
able capacity. API performance is often measured in requests per second. For example, a 
cloud service such as a database requesting writes to a storage object may have an upper 
limit of 100 per second. When the database writes exceed 100 per second, buffering may 
occur or additional charges could apply. 

API requests are measured and can be tracked from baseline measurements to determine 
whether there is a variation. It may be as simple as adding to your contracted API capacity, 
or you may have to divide the requests across more than one interface. 

To troubleshoot API issues, it is helpful to review your log files for any API-related 
errors or alerts. Also, monitoring applications can display actual compared to available API 
capacity. 


Bandwidth 


Server machine images allow for a selection of adapter speeds, usually offered in 1Gbps or 
10Gbps options. Network I/O is a measurable object whose metrics should be included in 
your baseline documentation. If network bandwidth exceeds Local Area Network (LAN) 
adapter capacity, you are left with two options; the first is to reduce that load on the adapter 
or upgrade to a higher-speed network interface. For applications that require high-speed and 
low-latency connections, it is best to place all of your VMs on the same hypervisor and use 
machine images that have 10Gbps Ethernet adapters installed for maximum bandwidth. 
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Bandwidth capacity from the cloud to the Internet can be a potential bottleneck. Public 
clouds will own this part of the network including management and troubleshooting. If it 
is a private cloud, you may have greater control over bandwidth capacity and utilization. If 
so, it will be your responsibility to work with your network carriers to increase the speed of 
your existing connection or add additional circuits. 

Network capacity starvation can lead to latency and degraded performance. 
Applications may time out, and for e-commerce sites, result in high customer 
dissatisfaction. 


Cloud Batch Job Scheduling 


Scheduling large cloud processing jobs can cause capacity issues in your cloud fleet. You 
will have your jobs scheduled ahead of the event, and this may entail purchasing compute 
instances on the spot, which may or may not be accepted. You can monitor the operation 
on your management servers to make sure that adequate resources have been applied for 
the batch job to run as expected. Troubleshooting may be required if the resources failed to 
deploy properly or the application failed. These issues can be reduced with offline model- 
ing prior to deployment. The cloud’s just-in-time metered service model allows you to test 
deployments ahead of them being placed into production and then to delete the test servers 
when the validation is complete. 

Large batch reports are often run on databases residing in the cloud. The jobs can cause 
contention with the production database replicas. If this is the issue, your database may 
slow down and cause a chain reaction of performance issues. If this is the case, it is often a 
best practice to create a separate read replica and run batch jobs from that, which frees up 
I/O to be used by the primary production application. 


Compute Resources 


A finite number of CPU cycles is available. It is common for operating systems and ap- 
plications to consume as much CPU power as possible. If it is there, use it! This allows for 
high-performance servers and applications with good response times. When you define your 
machine image, you request the speed of the CPU and number of cores. Prior to migrating 

to the cloud, it is helpful to get a measurement of the processing power used prior to the 
migration. If it is a new deployment, you may have to rely on vendor documentation or what 
others have experienced. 

Operating systems have utilities that monitor CPU utilization at the VM level and also at 
the hypervisor level. This, of course, is a critical object to measure and track. With current 
measurements, deltas and trends can be determined from your baseline, and remediation 
can be performed prior to this becoming a serious issue. 

In the event of CPU starvation, the only option is to either reduce what is consuming the 
resources, admittedly not always a viable option, or add CPU resources. 


Network Addressing 


IP addressing is another area where capacity plays an important role. When you configure 
your cloud deployment, one of the configuration points is the size of the network subnets 
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that are determined by the IP address block’s subnet mask. Make sure that you specify a 
subnet that is large enough not only for current requirements but also takes into account 
future growth. 

The lesson here is to specify your subnets to have enough capacity that you will not 
exceed them in the future. Readdressing your devices is not anything you would ever care 
to do. However, you can usually add more subnets and route between them as a good 
solution. 

When designing and assigning your network addresses, be aware that there may be 
reserved addresses that you cannot use. Some of these may be for the default gateway, DNS, 
NTP, or any number of services. These will be documented by the cloud provider. 


Storage Capacity 


One cloud resource that always seems to grow and grow is storage. Storage volume utiliza- 
tion can be tracked as a managed object, and triggers can be configured to alert operations 
at a predefined usage threshold. Managing storage capacity is a critical task; if a storage 
volume fills up, applications can fail, and data can be lost. Watch this closely! 

To resolve storage capacity problems, you can migrate the data to a larger volume, or if 
you have elastic storage volumes, increase the capacity. 


Variance in Number of Users 


When collecting data for your baselines and ongoing operations, the number of concurrent 
users on the platform is a useful metric to track. Usage can show you how many users are 
visiting your site over time and display valuable information on peaks and valleys of usage 
by the hour, day, and month. Site activity can, of course, be an important measurement for 
planning additional capacity. 

When troubleshooting cloud performance issues, the current number of users on the 
system can be an important indicator of load. When there are high user counts, you can 
track what parts of your deployment are most heavily used and track the load on all the 
devices to see where the congestion points are. Also, tracking users and the variance from 
your baseline is critical to managing software license models based on user counts. Many 
identity access control systems have maximum user hard limits that need to be monitored 
and managed. 


Exceeding Your Baseline Measurements 


In many ways, exceeding the baselines that you have created, monitored, and managed is a 
good outcome. When you exceed the metrics of the past, it can be a measurement of success 
in that your operations are growing and expanding. This is what you could call a “high- 
quality problem!” 

Growing and expanding your operations is a measure of success. You just need to 
track and manage the growth. If you are proactive and deploy the needed modifica- 
tions before any performance or capacity issues are realized, you are an effective Cloud+ 
professional! 
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By tracking your growth and comparing current workloads to those on your baseline 
measurements, you can be prepared to troubleshoot and manage you cloud fleet proactively. 
This chapter offers examples of common objects, services, and systems that you may need 
to troubleshoot. Be prepared and you can either avoid or be ready to troubleshoot cloud 
problems as they arise. 


Expecting the Unexpected, Unplanned Expansions 


As any longtime information technology professional will tell you, “Expect the unexpected, 
and you will not be surprised when it comes.” Be prepared and have solid notes, diagrams, 
configuration documentation, and logs. Know how to quickly access them and make sure 
they are reachable during an outage. Think through and brainstorm with your co-workers 
various scenarios and how to quickly and effectively deal with them. 

Growth in business operations or through mergers and acquisitions can challenge your 
expansion planning. However, the on-demand rapid provisioning model of cloud comput- 
ing allows you to rapidly deploy additional resources to meet these needs. With clarity of 
what your deployment currently is and what you need to add, you can architect the changes 
and manage a smooth deployment to meet your new requirements. 


Troubleshooting Automation 
and Orchestration 


This section covers automation and orchestration service troubleshooting. You learned 
earlier in the chapter that oftentimes these systems are going to be out of your reach to 
troubleshoot and manage because they are controlled by the cloud service provider. If you 
are operating in a public cloud environment, then you should have more access to the under- 
lying code to troubleshoot automated cloud applications. 

You can compare the input to the output of automation and orchestration systems to 
determine whether what you requested was what was actually delivered. Based on the 
results of your troubleshooting, you can either open a trouble ticket with the public cloud 
company or work internally with your development teams to troubleshoot the issue. 

Many of these systems are in the public software domain and supported with the open 
community model. If this is the case, you can be assured that if you are seeing a problem, 
many others are as well. Check the online support boards and discussion groups and par- 
ticipate in the resolution of the issue you are troubleshooting. 


Process and Workflow Issues 


Many problems can be traced back to process, planning, implementation, and validation 
deficiencies. These issues tend to get worked out over time as you gain experience operating in 
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a cloud environment. In the following sections, you will become familiar with some of the 
more common process and workflow issues. With a basic understanding of these issues, you 
should be able to more effectively deal with them should they ever arise. 


Account Mismatch 


Accounts include users and groups that are defined in the cloud management console. Once 
a user is defined, the user can be either placed into a group of other users with the same job 
function, such as storage operators, or assigned privileges directly. 

Should these privileges not match what is required for either the user or group of users 
to do their jobs, you may be called upon to troubleshoot the issue. You need to determine 
what rights are needed. Are they valid rights for these users and groups to assume, and are 
they correctly defined in the identity and access console in the cloud? 

Since this can be a security issue, it is important that you make sure all of the approvals 
are in place and then verify, via the console, that the accounts are correctly configured for 
their intended roles. 


Change Management Breakdowns 


What happens when two changes are approved for the same night and the same time but 
the network guys take their downtime at the same time the server team is trying to install 
patches across the network? Well, nothing happens for the server team until the network 
engineers bring up the LAN so the servers can reach remote resources. This is just one of 
many examples of the hidden complexities of the change management process. There are 
many dependencies, and they all must be investigated to make sure that one operation does 
not have a negative impact on other changes planned at the same time. 

As you have already learned, change management requires a written plan that includes 
all contingencies as well as participating in change review meetings to discuss upcoming 
changes. During the change window, you must be prepared to react to anything that can 
go wrong. For example, the server team must be able to react if the network is down and 
cannot access the needed files. If the team is in the middle of upgrading the servers and the 
network goes down, there needs to be a contingency plan to roll back any of the changes if 
required. 

Afterward, action reports and reviews can be useful to discuss what went wrong, why, 
and what can be done to prevent a recurrence of the same issue from happening again. 


DNS and Server Name Changes 


Sometimes workflow problems are the subtle but important changes that need to be made 
but are easy to overlook. Once you forget these types of issues once, I guarantee that you 
will always remember them going forward! 

DNS maps human-readable domain names to the IP addressing scheme used by the 
Internet. It’s just like a phone directory that tells you Bob is at 555-1212. So, if you, for 
example, change a server’s IP address or add a new load balancer to your deployment, there 
will be a DNS change or addition. 
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Since most services and users call the devices by their domain name, you must have 
defined the DNS entry. If you failed to make the DNS record entry, then the device will not 
be reachable unless you happen to know its IP address. 

Keep this in mind when troubleshooting connectivity issues, primarily if there are time- 
outs or services that just never respond to connection requests. The nslookup utility really 
comes in handy for troubleshooting DNS problems; it allows you to query a DNS server 
using a command line where you enter the domain name and the DNS server replies with 
the IP address or an error message if there is no record. This allows you to see whether 
there is anything in the DNS server’s database for that domain name or whether the infor- 
mation is inaccurate. 


Incompatibility of Automation Tools 


With so many components and with each service in the cloud being driven by software and 
automation, it is inevitable that there are going to be software compatibility issues. One 
moment everything is working fine, and then after the overnight changes, nothing seems to 
work. This can often be traced to incompatibility between orchestration or automation tools 
and the systems they are intended to communicate with. 

When these types of issues are reported, it is helpful to query all the active parties 
involved to see what was changed since the systems reporting the error were last opera- 
tional. It can often be traced to a patch being applied or an application being upgraded that 
caused the automation systems to no longer be able to communicate. Are there new API 
security requirements, or did the communications’ interface change? Are there new user 
rights issues that require you to change your existing identity and access manager configu- 
rations? Sometimes a solid review of your logging files will provide information on where 
and what the issue is. 

If you are using a public cloud service model, then the automation and orchestration sys- 
tems will be out of your direct control as they are owned and managed by the public cloud 
provider. Your only real option is to open a trouble ticket to track the resolution with them. 
If the maintenance of the systems are in-house as is usually the case in a private cloud, 
then you can work with your internal development groups to troubleshoot and resolve the 
problem. 


IP Address Changes 


Changing your IP addressing scheme requires careful planning and a thorough validation af- 
ter the changes have been implemented. You just learned about the importance of keeping the 
DNS records up-to-date. In addition to DNS, you must also verify that any access control lists 
that reference the old IP address be modified to reflect the new address. This is also the case 
for firewall rules and network routing tables. Also, the devices connected, such as servers or 
storage devices that have IP addresses assigned to their interfaces, will need to be reconfigured 
and tested. This project can often become a larger than expected undertaking. 

A carefully outlined change management plan will be invaluable in defining the steps 
required during an address change readdressing project, including the testing and valida- 
tion process and, if needed, how to back out. 
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Location Changes 


Moving a deployment to another location can be completely transparent or a huge change 
management project! Most cloud providers have multiple availability zones in their cloud 
regions and can move services and servers automatically from one to the other should there 
be an outage. This level of resiliency is commonly automated in the SaaS model. If you are 
deploying your own applications, it is often up to you to design for changes. While every 
cloud provider is ns with little or no impact to your production operations. 

Should the plan be to move services from one region to another, then you can expect 
some downtime to shut down services in one region and bring them up in another. These 
types of changes should be well-planned and tested prior to implementing to make sure all 
goes well. 

Possibly the most complex location change is migrating between service providers or 
deployment models. For example, moving from your company’s internal data center to a 
public cloud’s SaaS offering is a significant change. One of the advantages of the public 
cloud is the ability to turn up a test fleet of servers and then delete it when you are finished. 
You pay a minimal amount of money to build a test bed prior to deployment. You should 
take advantage of this flexibility and completely test your migration offline well in advance 
of making the changes. This allows you to fully plan and document location changes and 
helps to ensure a smooth transition. 


Version and Feature Mismatch Issues 


Many applications have dependencies on others. As you go through your change manage- 
ment process of applying patches, hot fixes, upgrades, and feature enhancements, you may 
encounter mismatch problems between applications. 

The application vendor may have done regression tests as part of its quality assurance 
processes and then posted the test results for you to review. If there are any problems with 
versioning, you can tell well ahead of time and plan accordingly. Investigate all documenta- 
tion and carefully read all release notes. A lot of planning up front here can save you from 
many problems later. 

However, if you make changes to your cloud deployment and then your systems no lon- 
ger communicate with each other or to the outside world with browser issues, for example, 
then you may have a critical situation that requires immediate troubleshooting. 

Collect all log files and any symptoms and document what was changed and what the 
corresponding symptoms were. Make sure that all interested parties, such as the virtualiza- 
tion, networking, security, storage, or application teams, are involved in the troubleshoot- 
ing. Also, check that all of the required features have been enabled and that their licensing 
requirements are valid. 


Work Validation Issues 


When performing a change management operation, you have learned that you must then 
test to make sure the change was implemented correctly and is operating as expected. This is 
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commonly referred to as validations. This is an important operation as it is critical that the 
change management process is followed and that when systems get put back into produc- 
tion, they are operating as expected. 

However, how do you know if the validation was accurate and complete in the first 
place? What if you performed the validation and learned after the system went live that 
there was a fatal flaw? The lesson here is that you need to make sure that the validation 
plan is complete, thorough, and accurate. 

Testing for proper operation will include testing to make sure the intended fix or feature 
upgrade is now in place after the change. You can also ask the organization publishing the 
fix what their testing and validation methodology was. You can then incorporate their test 
suites into your validation documentation. A common practice is to also add tests to verify 
that what was originally working still works! Look at closely related features to the ones 
that you changed and run several tests to make sure they are operating as they were before 
the upgrades. 

Peer review can be helpful when creating validation plans. It is a good practice to sit 
down with your peers and mark up the validation plans to constantly improve them. Over 
time you will build a library of validation test plans that are reusable. 


Summary 


This chapter covered troubleshooting and investigated many of the services and components 
that you may be called upon to troubleshoot. 

There are hundreds of services available in the cloud, and most of them are intercon- 
nected, or interoperate, in a limitless number of combinations. To be effective in support- 
ing and troubleshooting your cloud deployment, it is important that you have an in-depth 
knowledge of your systems, configuration repositories, diagrams, and extensive documen- 
tation. As you no know, this is a huge topic area that a whole bookshelf full of volumes 
discussing the subject could not completely cover. What is expected is that you have an 
awareness of the main troubleshooting areas covered in this chapter and be able to identify 
the key points discussed on the exam. 

Common cloud issues that may require troubleshooting include automation, interoper- 
ability, interconnections, software language support, licensing, networking, resource con- 
tention and starvation, outages, template issues, time synchronization, and workflows. 

All of these issues (and more) will require that the Cloud+ professional have an under- 
standing of what these systems are, what they do, and how to resolve issues as they arise. 
You were given an overview of each and learned how to troubleshoot each one. Many of 
the troubleshooting techniques are universal so they can be applied to any cloud model of 
provider offerings. However, most cloud companies will offer their own interfaces and have 
different polices on what you can access and what is internal to the provider. 

As your operations grow, it can be expected that what worked yesterday may not be suf- 
ficiently robust enough to work tomorrow. You learned about capacity issues and how to 
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measure changes against your baselines. The capacity issues covered in this chapter include 
API request capacity, network bandwidth, batch job scheduling, compute resources, licens- 
ing, network address constraints, and making sure your systems can handle the required 
number of users accessing the system. 

When the baseline measurements are consistently exceeded, actions must be taken to 
ensure your system has the resources needed to meet demand. How to determine where 
the capacity issues are using baseline comparisons and then adding resources to address 
the capacity shortage were outlined. There may be times when unexpected growth or 
unplanned expansions are going to need to be performed, and a solid understanding of 
these issues is necessary. This chapter discussed a basic plan on how to undertake cloud 
expansions. 

Modern cloud systems are a marvel in their automation and orchestration capabilities. 
However, when automated systems fail or do not operate as expected, your job as a 
Cloud+ professional can get very interesting very quickly! You were given an overview of 
these software-based systems and what to look for in performing basic troubleshooting. 
You will most certainly come across issues with automation tools that do not work well 
with the services the automation systems are configuring. It was noted that automation and 
orchestration systems may be the responsibility of the cloud provider, and tips were given 
on how to proceed in these situations. 

Cloud processes and workflows tend to get refined over time as you gain experience in 
your operations. Common topics include defining accounts to match your requirements, 
dealing with conflicts, and creating workflow sequences in the change management pro- 
cess. These are critical to understand and resolve to prevent a recurrence of the same issues. 
You learned about how to keep your DNS and server records up-to-date with changes such 
as IP address migrations. 

Changes to your cloud fleet are a fact of life, and the change management process helps 
to lesson any problems by undergoing a structured planning process. Some of the changes 
may include moving your cloud operations to a new location or having to change the net- 
work address scheme to either segment the network or to expand. These can be rather dras- 
tic changes, and proper planning, including how to validate the changes, was introduced in 
this chapter. 


Exam Essentials 


Know the key concepts of troubleshooting. Keep up-to-date documentation of your net- 
work, backup of current configurations, and current diagrams. You may be asked questions 
about planning for outages or basic troubleshooting preparedness and what records you 
should have available. 


Know the basics of common problems that require troubleshooting. While there are limit- 
less issues that may require troubleshooting, for the exam be prepared for scenario-based 
questions that will ask you to select a specific service from multiple choices. 
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Explain capacity-related issues and how to identify and resolve them. The exam may 
quiz you on capacity starvation and verify that you know how to troubleshoot issues such 
as CPU, memory, network, licensing, API requests, or storage limitations and then how to 
resolve the problems once they have been identified. 


Know how to identify and troubleshoot workflow issues. Workflows include account mis- 
matches; failures in the change management process; and critical changes in IP, DNS, server 
names, or locations. The exam will present these topics as scenario questions where you are 
expected to identify the underlying issues. 


Understand automation and orchestration. You will be expected to know how to validate 
that the automation and orchestration systems perform as expected and how to troubleshoot 
any problems. You need to understand that these systems are often the responsibility of the 
service provider and that you will need to rely on them to perform any troubleshooting. 


Written Lab 


Fill in the blanks for the questions provided in the written lab. You can find the answers to 
the written labs in Appendix B. 





1. _______are software representations of network systems. 

2. allows all devices to synchronize to a central 
time service. 

3. _______can be defined as the maximum amount that something can contain 
or support. 





4. Inthe event of CPU capacity starvations, you can either 

















or 
Expansion planning can be unexpectedly challenged by and 
DNS maps the to an 
After implementing a change, you should always ___ that it is working as 
expected. 

8. A centralized collection of device activity, known as , assists in 
analyzing events during troubleshooting. 

9. _______s backups are valuable for quick restoration of a failed cloud service. 

10. Proper network ______ allow for a visual representation of your cloud deployment 


and facilitate troubleshooting. 
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Review Questions 


The following questions are designed to test your understanding of this chapter’s material. 
For more information on how to obtain additional questions, please see this book’s intro- 
duction. You can find the answers in Appendix A. 


1. Common cloud resources in your deployment that may saturate over time include which of 
the following? (Choose three.) 
A. RAM 

B. Power 

C. CPU 

D. Storage 

E. Monitoring 

F. TaaS 

2. Connie has noticed an increase in the response time of the SQL database application she runs 
in her IaaS deployment. When comparing current results against her baseline measurements 


that she recorded when the database was deployed, she verified that there has been a steady 
increase in the number of read requests. What should she focus her troubleshooting on? 


A. Memory 
B. CPU 
C. Storage 


D. Networking 

3. What are recommended procedures to take when preparing an outage response plan? 
(Choose three.) 
A. Configuration backups 
B. SLA 
C. Documentation 
D. Diagrams 
E. PaaS 

4. Jeff has been monitoring resource usage increases in his web server farm. Based on trending 
data he has collected, there will be regular requirements to increase CPU capacity for his 
web servers as usage increases. Jeff wants to use the automation capabilities of his private 


cloud to automatically use the orchestration software to add CPU cores as required. What 
can he implement to automate this? 


A. Puppet 

B. Chef 

C. Docker 

D. Autoscaling 
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E. SaaS 

F. OpenStack 

G.  Resilient-scaling 

Sharon posted a new software update to her company’s popular smartphone application. 


After announcing the release, she has been monitoring her dashboard information and has 
noticed a large spike in activity. What cloud resource should she focus on? 


A. CPU 

B. Network bandwidth 
Cc. RAM 

D. API 

E. Storage 


Jim has added a new group of users to his laaS-based NoSQL database. What license 
requirements does he need to investigate to ensure compliance? (Choose all that apply.) 
Total connections 


Named users 


A 
B 
C. Current connections 
D. Usage metrics 

E 


All of the above 


Hank designed an application tier for his company’s new e-commerce site. He decided on 
using an IP subnet that uses a /28 IPv4 subnet. He is planning for a maximum of 14 servers. 
You are brought in as a cloud architect to validate his design. What other devices may be on 
this subnet other than the servers that would also require IP address assignments? (Choose 
three.) 


A. SLA 

B. Default gateway 
Cc. DNS 

D. NTP 

E. API 

F. SNMP 


Dale has been monitoring storage volume utilization and is writing a change request to add 
capacity. He has decided to automate the volume allocation size. What cloud feature can he 
take advantage of? 


A. SaaS 

B. API 

C. Elasticity 
D. OpenStack 


10. 


11. 


12. 


13. 
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Performance issues are measured by the load on a system. Which of the following should 
Jane be concerned about as she integrates her new marketing group into her PaaS cloud 
fleet? 


A. APIs 
B. Users 
C. Cores 


D. Licensing 


Cloud capacity can be measured by comparing current usage to what? 


A. Orchestration 
B. Automation 
C. NTP 

D. Baseline 

E. APIs 


SaaS orchestration systems are whose responsibility in the public cloud? 


A. Customer 


B. Provider 
C. Automation vendor 
D. DevOps 


During a recent downtime window, the server team was applying patches to an application, 
and the networking team was upgrading a router’s interface to 10Gbps. When the network 
was down for the upgrade, the server team complained that they could not download the 
needed software patches. During a post-downtime status meeting, it was determined that 
which process should be modified to prevent this from happening in the future? 


A. Orchestration 

B. Automation 

C. Change management 

D. API calls 

Jerry is expanding a public subnet in his company’s e-commerce site. After performing the 
address change for all of his public-facing web servers, he tested connecting from a bastion 


host located offshore. He was unable to connect. What does he need to change to allow the 
remote site to connect to the web server? 


A. NTP 
B. STP 
Cc. DNS 
D. API 
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14. 


15. 


16. 


17. 


18. 


19. 


20. 
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What are software representations of a cloud network? 
A. Automation 

B. Templates 

C. Orchestration 

D. APIs 


What application tracks a process from start to finish? 


A. API 
B. NTP 
C. Workflow 


D. Orchestration 


Capacity boundaries can cause which of the following? (Choose three.) 
A. Application failure 
B. Latency 

C. API abends 

D. Request drops 

E. Workflow loops 


API request capacity is measured with what metric? 
A. Total lookups per second 

B. Connections per second 

C. Burst capacity 

D. IOPS 


Large batch processing jobs are common for which type of application? 
A. DNS 

B. NTP 

C. Databases 

D. Middleware 


When configuring a machine image, what compute resources do you define? (Choose two.) 
A. Slots 


B. Cores 
C. Clock speed 
D. Threads 


What determines the size of a group of servers sharing the same network range? 


A. Default gateway 


B. DNS 
C. NTP 
D. Subnet 


Troubleshooting 
Networking and 
Security Issues 
and Understanding 
Methodologies 





THE FOLLOWING COMPTIA CLOUD+ EXAM 
OBJECTIVES ARE COVERED IN THIS 
CHAPTER: 


Z 5.4 Given a scenario, troubleshoot connectivity issues. 
a Common networking issues 
a Incorrect subnet 
= Incorrect IP address 
= Incorrect gateway 
= Incorrect routing 
a DNS errors 
a QoS issues 
a Misconfigured VLAN or VXLAN 
= Misconfigured firewall rule 
= Insufficient bandwidth 
a Latency 
a Misconfigured MTU/MSS 
a Misconfigured proxy 
a Network tool outputs 
a Network connectivity tools 
= ping 


= tracert/traceroute 








= telnet 

= netstat 

= nslookup/dig 

= ipconfig/ifconfig 
= route 

= arp 

= ssh 

= tcpdump 


Remote access tools for troubleshooting 


Given a scenario, troubleshoot security issues. 
Authentication issues 
a Account lockout/expiration 
Authorization issues 
Federation and single sign-on issues 
Certificate expiration 
Certification misconfiguration 
External attacks 
Internal attacks 
Privilege escalation 
Internal role change 
External role change 
Security device failure 
Incorrect hardening settings 
Unencrypted communication 
Unauthorized physical access 
Unencrypted data 
Weak or obsolete security technologies 
Insufficient security controls and processes 


Tunneling or encryption issues 


Z 5.6 Given a scenario, explain the troubleshooting 
methodology. 


= Always consider corporate policies, procedures and impacts 
before implementing changes 


= Identify the problem 


= Question the user and identify user changes to the 
computer and perform backups before making changes 


a Establish a theory of probable cause (question the 
obvious) 


= If necessary, conduct internal or external research 
based on symptoms 


= Test the theory to determine cause 


= Once the theory is confirmed, determine the next steps 
to resolve the problem 


= Ifthe theory is not confirmed, reestablish a new theory 
or escalate 


= Establish a plan of action to resolve the problem and 
implement the solution 


= Verify full system functionality and, if applicable, 
implement preventive measures 


a Document findings, actions, and outcomes 





In this final chapter, the focus will again be on networking 
and, specifically, the tools and techniques that you can use to 
BEASTS identify and resolve network-related problems. In the previous 
chapter, I introduced network troubleshooting for interconnections, capacity issues, band- 
width, and addressing limitations. 

I will go into much more detail in this final chapter and cover the many tools that can be 
used to gather information and resolve networking problems. While networking is a topic 
area of its own, for the Cloud+ exam you need to focus on the specific areas of networking 
that you will most likely encounter. 

Security configurations and troubleshooting have become critical areas of concern for 
companies deploying services in the cloud. Throughout this book, I have discussed many 
different aspects of security. In this chapter, I will cover how to troubleshoot your security 
objects. 

You will also learn about the processes of different troubleshooting approaches that will 
make you more effective as a Cloud+ professional. 





Troubleshooting Cloud 
Networking Issues 


Networking plays a critical role in the cloud just as it does for any data center or corpo- 
rate operation. When the network is not fully functional, all of the services connected to it 
may be degraded or fail. With networks being the lifeline of any corporation, it is abso- 
lutely critical that you be able to quickly and effectively resolve issues with the network as 
they arise. 

While CompTIA offers certification specific to networking, it also expects cloud engi- 
neers to be familiar with networking. 

Cloud providers will be responsible for the core network in their facilities. This includes 
the connections to the Internet and high-speed fiber links that interconnect cloud zones and 
regions. The backbone switching and routing inside the data centers will also be managed 
by the cloud companies. The separation of responsibilities will be outlined in the service 
level agreement, with associated uptime commitments. 

Depending on the cloud services you have implemented, you may be responsible for 
many network-related technologies such as IP addressing, Virtual Private Networks (VPN) 
or direct interconnections, local routing configurations, and network services such as 
Domain Name System (DNS) and dynamic Host Configuration Protocol (DHCP). 
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In the all too likely event of a network impairment or outage, you must be able to deter- 
mine where the problem is originating from and who has the ultimate responsibility for 
resolution. In this section, you will learn about identifying issues as they arise. 


Identifying the Common Networking Issues in the Cloud 


A common networking issue covered on the exam is the IP addressing plan for your deploy- 
ment. You must understand not only the actual IP address but also subnetting, understand 
what a gateway is, and possess a basic knowledge of routing. This section will introduce you 
to addressing, subnetting, gateways, and troubleshooting. 

Network latency is the actual delay, or time, required for data to traverse across a net- 
work. While some delay is inevitable, if the network latency becomes too great, you will 
experience application issues. I will discuss latency in this section. 

When a network becomes congested, you are able to configure quality of service (QoS) 
parameters that allow for the prioritization of certain traffic types over others. This sec- 
tion covers QoS as is required for the Cloud+ exam and as it pertains to cloud computing in 
general. 

Network services such as Domain Name System servers, firewalls, and proxy systems 
play an important role in a well-designed network. You will become familiar with these 
services and gain a basic understanding of how to troubleshoot them. 

At the lower levels of the cloud network, configuration and troubleshooting of Virtual 
Local Area Network (VLAN)/Virtual Extensible LANs (VXLAN) and frame size must 
be addressed. You will be given a basic overview in this section so you can be aware of the 
configurations of networks at the data-link layer. 


Incorrect Subnet Issues 


In the cloud or a private data center, application servers are commonly grouped together in 
the same IP subnet and VLAN. By architecting the network in this manner, you ensure that 
the devices can send data directly to each other on the network and not have to traverse a 
router interface to a remote network. This decreases the network workload and increases 
performance since all communications remain local. 

For security reasons, when servers are grouped together in the same subnet, efficient 
firewall rules can be created to restrict and permit what traffic is allowed to and from the 
subnet. 

The IP address contains two sections. The first bits in the 32-bit address block identify the 
network number, and the remaining bits are the hosts, or devices, inside that network. The 
addressing is flexible and can be adjusted using what is known as a subnet mask. The mask 
determines the total number of hosts on each network. All hosts will contain this mask infor- 
mation to determine which network they are on. The subnet masks must exactly match, or 
you will have network connectivity problems with the incorrectly configured resources. 

Your documentation will contain your addressing scheme, show the subnets in use, and 
provide you with the correct subnet mask and address blocks. With this information, you 
can investigate the interface configurations and verify that the IP address, subnet mask, and 
default gateway are correct. 
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Incorrect IP Addressing 


IP addressing is required for all devices connected to the network to be able to communicate. 
When deploying a new presence in the cloud, part of the engineering, design, and architec- 
ture process includes creating an IP address scheme. At implementation time, a validation 
test will verify that the addressing is configured correctly and is operational. 

When IP addressing issues arise after a network has been deployed, troubleshooting 
should include asking whether there were any changes made recently. If so, investigate what 
was changed and whether that could have created the issues you are troubleshooting. 

IP addresses must be in the correct range for the subnet they are residing on. If they are 
out of range, they will not be able to communicate with devices inside or outside of the 
network. Also, some addresses in the subnet will be reserved for networking services. This 
is especially true for the default gateway’s IP address, which, by convention, is the lowest 
number in the range. The block range and reserved IP addresses are integral parts of your 
documentation. 

One of the more common addressing issues occurs when two devices on the same net- 
work are configured with the same address. This is not valid as each device must have a 
unique address. Just think of the confusion if the same phone number were assigned to 
more than one person! The symptoms of duplicate IP assignments are intermittent com- 
munications. Using the ping utility, verify that you are getting a 100 percent response rate 
from a host on the same subnet. If it is anything less, investigate a duplicate IP address 
issue. You can also look at the ARP table and see if a MAC address mapped to an IP 
address changes to another address. This indicates that an IP address is assigned to two or 
more devices and is an invalid configuration. 


Incorrect Default Gateways and Routing 


The term default gateway can be misleading since a gateway is now called a router. But a 
default gateway is the IP address on the interface on the router on the local subnet that con- 
nects to the outside world. It gives computers on one network a path to other networks. 

For example, a cloud web server that serves content to the Internet will reply by first 
sending the data to the default gateway router, which, in turn, forwards the data to the 
destination on the Internet. 

Each device connected to the network must have knowledge of the router’s address to 
send data to the outside world. This is commonly called the default gateway IP address. 
Your network documentation should include the IP address for its locally connected 
interface. 

When a device is sending data to the network, it first looks to see whether the destination is 
local or remote. If the endpoint is local, the data is delivered directly to that device. However, 
if the reply is destined for a remote network, the server will not have any knowledge of where 
it is, other than that it is not local. In this case, the data frame is passed to the default gateway, 
or router, which, based on its routing tables, has knowledge of where to send the data. 

When troubleshooting a networking scenario where you can use ping to connect to 
devices on the same subnet but are unable to connect to anything outside of the subnet, 
check the default gateway configuration on the local host and ping the default gateway’s IP 


Troubleshooting Cloud Networking Issues 293 


address. If you can ping the gateway, the local configuration should be good, and there is 
most likely a routing issue. 


Network Infrastructure Troubleshooting 


Generally, the infrastructure in the cloud data center is the responsibility of the cloud service 
provider. For example, power, cooling, physical security, and all other facilities-related com- 
ponents are owned by the cloud provider. With this separation of responsibilities, all infra- 
structure will be managed by the cloud provider. 

It is common for cloud providers to publish uptime and status reports on a browser- 
accessible dashboard. These dashboard services allow you to monitor the status of all facili- 
ties for alarms and will outline any current issues the cloud provider may be experiencing. 


Network Latency Troubleshooting 


As defined earlier, network latency is the delay, or time, it takes for data to traverse a 
network. Delay can be important for applications such as voice and live video that will 
experience performance degradation in high-latency networks. For example, if the network 
imposes long delays that companies use for voice traffic, it can be difficult for the two parties 
talking on the phone to communicate. When applications and storage data are transitioned 
to the cloud, they must be accessed remotely. This contributes to congested networks that 
lead to delays because packets must contend for limited network bandwidth. Network 
response time becomes critical, and the latency in the network when accessing the cloud is a 
critical factor in network performance. 

Electrons and photons in a network travel near the speed of light at 186,000 miles per 
second, which is the baseline speed of data passing through a copper wire or fiber-optic 
cable. However, if the data uses a satellite, significant delays will be incurred even at this 
speed because of the distances involved with going from the earth up to the satellite and 
back down again. There is also latency when the data must be buffered inside a switch or 
router as it is queued for transmission or processed for compression. The processing time 
to take a byte of data and serialize it to be transmitted and then reassembled at the remote 
location also adds to the latency. It is important to remember that you should calculate the 
end-to-end latency as your primary measurement and not the latency of each individual 
device in the patch from the source to the destination. 

Many network management tools as well as integrated test capabilities in the network 
gear can track latency and even generate alerts if latency exceeds a predefined threshold. 

Network latency is the delay incurred as a frame traverses the network. Each network 
device will receive the frame, compute a Cyclic Redundancy Check (CRC) error check, look 
up the exit interface, and send the frame out that interface. There are also delays in the 
serialization of the frame to exit the interface. When the frame passes through a firewall, it 
will be compared against the firewall rule set to determine if it is permitted or denied, and 
the data will be delayed during this process. If there is contention in the network, the frame 
may be buffered until network bandwidth becomes available. Quality-of-service policies 
may allow higher-priority frames to be forwarded and lower-priority frames to be buffered, 
which can also contribute to network latency. Figure 10.1 shows end-to-end latency. 
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FIGURE 10.1 Latency is an end-to-end network delay. 


E 


Network latency can vary widely in the cloud data center given the bursty nature of 
Local Area Network (LAN) traffic and orchestration systems constantly adding and moving 
VMs and causing constant changes in network traffic flows. In the cloud backbone network, 
higher-speed interfaces are deployed with link aggregation that can reduce latency. 

In the data center, latency can be controlled, monitored, and managed to ensure that it 
does not affect applications or user experiences. However, outside the cloud data center on 
the Internet, latency can be a much larger issue and out of your area of control. With the 
increase in smartphones and mobile technology, latency can vary widely as you move from 
one cell tower to the next, for example. 

Network monitoring systems and benchmarks will record standard latency and may also 
report current metrics. A simple ping test from the source device to the remote will report, 
as part of its standard output, what the end-to-end delays are across the network from the 
source to the destination and back again. 





Domain Name System 


There are many different network services in the cloud. These can include load balancers, 
firewalls, IDSs/IPSs, and DNS and DHCP devices, to name a few. 

DNS will need regular configuration updates as hosts and devices are added to, and 
removed from, the network. “A” records that map the domain name to the IP address need 
to be changed every time a device’s name has been modified, deleted, or added. While many 
cloud providers offer DNS services, it is usually your responsibility to actually mange the 
day-to-day operations of DNS. 

Troubleshooting will consist of verifying that the current configuration of the DNS 
records matches the addressing in each server. If there is a mismatch, devices trying to 
reach a host in your cloud fleet by its domain name may be offered an incorrect IP address 
that causes the requesting device to contact the incorrect server. Use the nslookup or dig 
utility to query the DNS server and verify that it is returning accurate information for the 
record you are troubleshooting. Also, to make sure that the DNS servers are reachable on 
the network, run a standard ping test. If the ping test fails, a traceroute to the server will 
show where along the path the traffic is stopping. 


Quality of Service 


Many different types of traffic are passing through your cloud data network. Not all of 
this traffic is created equally. Different types of applications have very different network 
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requirements. Actions such as transferring files or sending an e-mail message are not delay- 
sensitive and have no issues with being buffered because of congestion as they traverse the 
network from source to destination. However, other types of traffic are susceptible to latency 
and jitter across the network. Collaboration applications send voice and video over the same 
network as all other traffic. However, if voice is delayed or a video conference is losing data 
and suffering long delays in the network, the quality will suffer and could ultimately cause 
the session to fail. The concept of quality of service addresses these issues. 

Quality of service (QoS) is a general networking term for the ability of the network to 
provide differentiated services based on information in the Ethernet packet. For example, 
voice and video traffic are real time and delay-sensitive, storage traffic requires a lossless 
connection, and mail and file transfers are not sensitive to network delays. Using QoS, the 
network can be configured to take the various application needs into consideration and 
determine the optimal ordering of traffic through the network. 

TCP/IP headers have fields that tell the networking devices how their QoS values are 
configured. Routers can also be configured to look at the port numbers or IP addresses to 
configure QoS in a network. The access layer switches can either honor the QoS settings in 
a frame or impose their own settings by modifying or stamping QoS values into the frame. 

Each device that the frame passes through must be configured to honor the QoS settings 
inside the frame, so the configuration can become complex. You can control QoS inside the 
data center but not over the Internet since the Internet backbone is beyond your administra- 
tive control. Also, if the network links are not saturated, then there is little need for QoS 
since there is no contention and ample bandwidth to transmit all traffic. However, when 
the links become saturated, then the QoS configurations can prioritize certain traffic flows 
over others. 

For example, the long file transfers that take place during a backup can involve a large 
amount of data moving across the network, but it is not time-sensitive on the delivery. Also, 
when you send an e-mail, you are not concerned if it is sent in real time. However, if you 
are talking on a telephone that uses Voice over IP, you will most certainly notice delays of 
more than 250 milliseconds. If you are meeting over a video conference, jitter or latency in 
the network can cause the screen to freeze or drop. 

If there is sufficient network capacity, there is available bandwidth for all traffic types. 
However, when the network interconnections reach 100 percent traffic load, then QoS is 
needed to arbitrate which traffic flows will take priority over the others. In normal opera- 
tions, traffic is forwarded on a first-come, first-serve basis. QoS may be configured, but 
there is no current need to prioritize traffic until the network saturates. 

You must also consider that the background control of the network, such as the routing 
protocols and the management applications, must command a high priority because if they 
are starved for bandwidth, the whole network could very well fail. 

QoS can be configured on each step of the network that will define the priority of the 
traffic being sent across the network. There are many variations to QoS, and it can be a 
quite complex topic. Understand that each packet has information in its headers that you 
can use to make QoS decisions, and the network devices can be configured to act on this 
information and favor one type of traffic over another. 
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Maximum Transmission Units 


The standard Ethernet frame called Maximum Transmit Unit (MTU) is 1,518 bytes, which 
defines the largest Ethernet frame size that can be transmitted into the network. Frames 
that are larger than the MTU are fragmented, or divided, into multiple frames to support 
the standard frame size. Any Ethernet frame larger than the standard size is referred to as a 
jumbo frame. 

It is often more efficient to use a larger Ethernet frame size than the standard Ethernet 
MTU inside the data center to reduce networking overhead. Jumbo frames allow for higher 
network performance by reducing the overhead in each Ethernet frame by using fewer but 
larger frames. Jumbo frames also reduce the number of times that a CPU will be inter- 
rupted to process Ethernet traffic since each jumbo frame can be up to six times as large as 
a standard frame. 

Jumbo frames are now common in the cloud and enterprise data centers and are extensively 
used for storage over LAN technologies such as Internet Small Computer Systems Interface 
(iSCSI) and Fibre Channel over Ethernet. Modern data center switches will usually support 
jumbo frames up to 9,000 bytes. To support jumbo frames in the network, you will need to 
enable this feature on the switches, Network Interface Cards (NIC), and any other devices in 
the data path. 

To troubleshoot MTU issues, look at the interface statistics to see whether there is frag- 
mentation taking place. If the MTU of a frame is too large, a router interface may fragment 
it into smaller frames. This is not an optimal situation, and you would need to verify that 
all devices in the source to destination path are configured for jumbo frames. The most 
common jumbo setting on network devices is 9,000 bytes, which is the standard frame size 
for storage traffic over the network. 


Available Bandwidth 


Bandwidth testing measures the throughput of the network, which directly affects the net- 
work response. A network with insufficient bandwidth will experience high latency, which 
may cause applications to fail or not work as expected. Many tools are available that you 
can use to measure network throughput. IPerf, for example, will give you a reading of the 
speed (in megabits per second) of the network from a source to a destination. Testing can 
also be as simple as downloading a large file and measuring the time the download takes to 
complete; based on that information, the actual network bandwidth can be calculated. It is 
important to note that in a cloud data center the core network will be architected with mul- 
tiple high-speed Ethernet links optimized for the traffic patterns commonly found in a data 
center. Also, network monitoring and management systems can alert the engineering staff if 
the links are saturated and additional bandwidth needs to be provisioned. 


Validating Firewall and Proxy Configurations 


After new firewall rules have been implemented, your change management plan will call for 
you to validate that the rule is operating as expected. A firewall rule will have a protocol, 
source and destination IP addresses or domain names, application port numbers, a permit or 
deny statement, and usually a firewall source and destination zone. 
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Firewall rules are compared in a top-down operation. When there is a match, the rule is 
acted upon, and further rule processing is stopped. Be aware that this order of operations 
can produce unexpected results. For instance, if you add the new rule at the bottom of the 
configuration that permits all Internet traffic to connect to an File Transfer Protocol (FTP) 
server on one of your public-facing cloud servers, check to see whether there is not another 
rule above this preventing FTP access to your site that gets checked before your new rule. 
In this case, the FTP deny rule would be seen first, and the connection would be blocked. 
Since there is no more rule processing that would be done, your permit FTP rule will never 
be seen. The solution would be to place the FTP permit higher in the search sequence than 
a deny rule. Enabling logging can provide invaluable troubleshooting information when 
troubleshooting a firewall as the data provided in the logs will specify exactly what the fire- 
wall is processing and give details on the rules it referenced. 

A proxy is a device that is inserted into the middle of a traffic flow and terminates the 
connections in both directions and monitors the traffic between the source and the desti- 
nation. Proxy systems are found in enterprise environments and in load balancers in the 
cloud. When troubleshooting proxy issues, make sure that the browser or client is not mis- 
configured for the proxy settings and has a valid IP address, subnet mask, and default gate- 
way. Verify that the URL of the site you are trying to reach is not down and that there are 
no ongoing network issues that may be the root cause of the problem. Check the log files 
for the device performing the proxy function that may indicate if the issue is local to the 
server. Test from another computer on the same subnet and a different subnet that connects 
through the same proxy server. Verify whether the problems are consistent or intermittent. 
By gathering the background information of the proxy issue, you can then work to deter- 
mine where the problem resides and develop a test and resolution plan. 


VLAN and VxLAN Issues 


VLANs and VxLANs are layer 2 segmentation standards that allow you to take physi- 

cal switches and logically divide them into many separate or individual logical switches. 
The IEEE 802.1D, often referred to as Dot1Q, defines VLANs that can have a maximum 
of 4,094 VLANs per system. This may seem like a large number, but many VLANs are re- 
served, and often the switches in the data center may not be able to support this maximum 
number. Dot1Q works by inserting a header in the Ethernet frame that identifies the VLAN 
that this frame belongs to. Also included in the header is the priority field that is used for 
QoS calculations. 

When hyperscale cloud computing arrived, it was clear that the standard VLAN limit of 
4,094 was insufficient. Even if every customer used just one VLAN (hint, they use many), 
the limit would be only around 4,000 customers! To increase the VLAN count, VxLAN 
was introduced. Also, traditional VLANs were intended to stay local to the data center and 
not be “stretched” across to a remote data center. 

VxLAN radically changes the way VLANs transit a network. VxLAN is an encapsulation 
method. It takes an Ethernet frame and encapsulates it in an IP packet using User Datagram 
Protocol (UDP) as its transport. Another name for this is MAC-in-IP encapsulation (some 
call it MAC-in-UDP) because the layer 2 frame is untouched and wrapped in a normal IP/ 
UDP packet. 
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The VxLAN header is 8 bytes, or 64 bits. The VxLAN Network Identifier (VNI) uses 24 
bits of that header. The VNI is synonymous with the traditional VLAN identifier discussed. 
In the VxLAN case, however, the VNI scales to more than 16 million segments. These are 
private segments too. Show me a cloud provider that doesn’t want 16 million segments 
belonging to millions of customers! The traditional VLAN ID maps to the VxLAN ID. For 
ease of use, some networks map similar numbers to a higher numerical number in VxLAN. 
The significance in VxLAN is the unique VxLAN ID. Each switch respects the mapping 
when encapsulating or removing the encapsulation. This helps cloud providers significantly, 
as there are more than 16 million VxLAN IDs. This solves the VLAN ID starvation aspect 
discussed earlier. 

Automation, routing, and specialized monitoring systems track VLAN/VxLAN con- 
figurations and operations. It is important to know that layer 2 VLANs will traditionally 
map to a layer 3 IP subnet. When troubleshooting, make sure that these mappings are 
correct and that the links, or trunks, that interconnect network switches have the VLANs 
configured on them to enable them to pass traffic on that VLAN from one switch to 
another. 

VxLAN troubleshooting will almost always fall to the cloud provider as this is consid- 
ered infrastructure. However, by analyzing log files, vendor monitoring applications, and 
command-line utilities, you can uncover where the issue is originating from and begin 
troubleshooting. 


Network Troubleshooting and Connectivity Tools 


A cloud network infrastructure is usually not static; rather, it changes as new services, serv- 
ers, and storage are added. In this section, you’ll learn about the tools commonly used to 
configure and troubleshoot the cloud network infrastructure. 

There are many different command-line tools and utilities that are invaluable for gath- 
ering information and for troubleshooting. You will learn about common command-line 
utilities found in the Windows and Linux operating systems that network engineers can 
use to learn how the network interfaces are configured, determine the current status of 
these interfaces, and gather valuable troubleshooting information. You can run com- 
mands to test connectivity, resolve domain names, look at routing tables, log into remote 
devices, and much more. Let’s look at the most common and useful utilities for network 
troubleshooting. 


ARP 


Have you ever wondered how a workstation can find a device on a network if it does not 
have complete addressing information needed to reach that device? Well, if it is a TCP/ IP 
device (as just about everything is nowadays), it will use the Address Resolution Protocol 
(ARP). ARP is the protocol that determines the mapping of the IP address to the physical 
MAC address on a local network. 

By using ARP, all devices on the LAN build a table of IP to MAC address bind- 
ings. For example, a workstation may need to communicate with a server at IP address 
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192.168.1.123. If it is in the same VLAN, the workstation will need to know the server’s 
physical, or MAC, address to construct an Ethernet frame with accurate source (workstation) 
and destination (server) MAC addresses. 

The workstation will send out an ARP broadcast frame to all devices in the VLAN 
requesting the MAC address of the 192.168.1.123 server. All devices on the local LAN will 
process the ARP request, and only the device that matches the 192.168.1.123 IP address 
will respond with its hardware address. 

When each device on the segment receives and looks into the ARP packet, it will 
ask, “Who has IP address 192.168.1.123?” If the receiving device is configured with 
that address, it will reply with “That is my IP address, and my Ethernet MAC address 
is attached.” Then communications can proceed because the device that sent the ARP 
packet now has all the information it needs to communicate with the remote device. 
Address resolution is constantly running in the background and rarely seen unless you 
have a packet sniffer attached to the network. To verify that the network or host you 
are logged into can see the remote device’s IP/MAC address, check the ARP tables when 
troubleshooting. 

The arp command-line utility will show information on the local ARP table, as shown 
in the following output from a Windows server: 


C:\Users\todd>arp -a 
Interface: 192.168.1.90 - Oxa 


Internet Address Physical Address Type 

192.168.1.1 d0-39-b3-4b-a9-83 dynamic 
192.168.1.67 d8-25-22-77-cb-c6 dynamic 
192.168.1.71 e4-98-d6-89-cc-bd dynamic 
192.168.1.75 f0-4f-7c-f1-92-e4 dynamic 
192.168.1.77 00-20-00-72-4a-fa dynamic 
192.168.1.78 a8-86-dd-9a-9d-7a dynamic 
192.168.1.80 84-a4-66-c5-a7-02 dynamic 
192.168.1.83 3c-a8-2a-a2-9c-7a dynamic 
192.168.1.89 00-10-75-44-1b-ad dynamic 
192.168.1.91 00-21-70-32-81-55 dynamic 
192.168.1.96 fc-db-b3-c5-31-bc dynamic 
192.168.1.249 00-02-b9-f8-cd-cO dynamic 
192.168.1.250 00-24-dc-d1-16-00 dynamic 
192.168.1.251 00-0d-65-49-87-00 dynamic 
192.168.1.254 d0-39-b3-4b-a9-80 dynamic 
192.168.1.255 ff-ff-ff-ff-ff-FfFf static 
224.0.0.5 01-00-5e-00-00-05 static 
224.0.0.22 01-00-5e-00-00-16 static 


224.0.0.253 01-00-5e-00-00-fd static 
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ipconfig/ifconfig 

ipconfig on Windows and ifconfig on Linux are command-line utilities used to verify and 
configure the local network interfaces. In the following example, this workstation is running 
both IP versions 4 and 6, and the addressing is provided in the command output. These utili- 
ties’ output can be expanded by using switches to obtain specific and detailed information. 
These are important troubleshooting tools to run to verify that the network interfaces are 
configured as expected. 


C:\Users\todd>ipconfig 
Windows IP Configuration 
Ethernet adapter Local Area Connection: 


Connection-specific DNS Suffix . : attlocal.net 

IPv6 Address. . . . 1... «ws . i 2602:306:8b80:2570: 340 

IPv6 Address. . . . . 2... . . . | 26023306: 8b80:2570:2d34:e50:95ef:1dcd Temporary 
IPv6 Address. . .. 1... ww . 2 2602:306:8b80:2570:c84b: £814: a4ce:cfel 
Link-local IPv6 Address... a... a.. . . i fe80::2d34:e50:95ef:1dcd%10 

IPv4 Address. .. s.o... . . | 192.168.1.90 

Subnet Mask... s w eosa ere a 3 255.255.255.0 

Default Gateway ......... : 192.168.1.1 


ifconfig is the Linux utility to view and change network interface configurations. 


host#ifconfig 

etho 

Link encap:Ethernet 

HWaddr 0B:55:65:DE:E9:23:F1 

inet addr:192.168.28.10 

Bcast:192.168.28.255 

Mask:255.255.255.0 

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 

RX packets:2472694671 errors:1 dropped:0 overruns:0 frame:0 
TX packets:44641779 errors:0 dropped:0 overruns:0 carrier:0 
collisions:0 txqueuelen:1000 

RX bytes:1761467179 (1679.7 Mb) 

TX bytes:2870928587 (2737.9 Mb) 


Interrupt: 28 


netstat 


netstat is a network statistics utility found on both Windows and Linux workstations and 
servers. You can use netstat when troubleshooting to see which network connections are 
open to remote applications, to view detailed protocol information, to see addresses used 
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both locally and remotely, and to determine which state the TCP connections are currently in 
on the device. The basic netstat output is illustrated here: 


C:\Users\todd>netstat 
Active Connections 


Proto Local Address Foreign Address State 

TCP 192.168.1.90:49546 8.18.25.62:https ESTABLISHED 
TCP 192.168.1.90:49550 unknown000d65498700: telnet ESTABLISHED 
TCP 192.168.1.90:49573 ec2-107-22-225-24:http ESTABLISHED 
TCP 192.168.1.90:49576 a-0001:https ESTABLISHED 
TCP 192.168.1.90:49577 a-0001:https ESTABLISHED 
TCP 192.168.1.90:49578 a-0001:https ESTABLISHED 
TCP 192.168.1.90:58113 os-in-f188:5228 ESTABLISHED 


There are many options for the netstat utility, including the one shown here where 
you’re asking for TCP network statistics. By combining netstat options, you can get gran- 


ular and detailed output like this: 


C:\Users\todd>netstat -ps 
IPv4 Statistics 


Packets Received 559794 
Received Header Errors 0 
Received Address Errors 35694 
Datagrams Forwarded 0 
Unknown Protocols Received 0 
Received Packets Discarded 16057 
Received Packets Delivered 871906 
Output Requests 286165 
Routing Discards 0 
Discarded Output Packets 75730 
Output Packet No Route 0 
Reassembly Required 16241 
Reassembly Successful 8085 
Reassembly Failures 0 
Datagrams Successfully Fragmented 0 
Datagrams Failing Fragmentation 0 
Fragments Created 0 
ICMPv4 Statistics 

Received Sent 

Messages 63761 31278 
Errors 0 0 
Destination Unreachable 63727 31242 
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TCP Statistics for IPv4 

Active Opens = 6293 
Passive Opens = 88 
Failed Connection Attempt = 50 
Reset Connections = 360 
Current Connections =1 
Segments Received = 109317 
Segments Sent = 83586 
Segments Retransmitted = 2593 


UDP Statistics for IPv4 
Datagrams Received 176647 
234005 
1 


156556 


No Ports 


Receive Errors 


Datagrams Sent 


nslookup/dig 


nslookup and dig are command-line utilities used to resolve hostnames to IP addresses using 
a DNS server. nslookup is the Windows variant, and its Linux equivalent is called dig. If you 
need to learn the IP address of a domain, use these applications to resolve the DNS name to 
the IP address, as shown here: 


C: \Users\todd>nslookup 

> 8.8.8.8 
Server: dsldevice.attlocal.net 
Address: 192.168.1.254 
Name: google-public-dns-a.google.com 
Address: 8.8.8.8 
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dig is a Linux-based utility that serves the same function. It queries a DNS system by 
giving a domain name and receives the corresponding IP address. While dig has extensive 
command options, the basic command returns a remarkable amount of information, as 
shown here: 


linux# dig www.google.com 

; <> DiG 9.3.3rc2 <> www.google.com 

; (1 server found) 

33 global options: printcmd 

33 Got answer: 

33 ->>HEADER<;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3 
33; QUESTION SECTION: 

;www. google.com. IN A 

3; ANSWER SECTION: 

http://www. google.com/. 43200 IN A 200.99.187.2 

3; AUTHORITY SECTION: 

http: //www.google.com/. 43200 IN NS ns2.google.com. 
http://www. google.com/. 43200 IN NS ns3.google.com. 
http://www. google.com/. 43200 IN NS nsl.google.com. 
3; ADDITIONAL SECTION: 

nsl.google.com. 43200 IN A 222.54.11.86 
ns2.google.com. 43200 IN A 220.225.37.222 
ns3.google.com. 43200 IN A 203.199.147.233 

33 Query time: 1 msec 

33 SERVER: 222.54.11.86#53(222.54.11.86) 

3; WHEN: Wed Nov 18 18:31:12 2009 

33 MSG SIZE rcvd: 152 

[root@tipofthehat ~]# 


ping 

ping is part of the TCP/IP family of protocols; it is used to verify that a device is available 
and reachable on the network and also to get a reading of the response time at that moment 
in time. You can send a ping packet to a remote IP address and have it return, as shown in 
the following example. This will tell you that the IP stack is configured correctly and that 
you can reach IP devices on both the local and remote networks. ping is a fundamental and 
frequently used troubleshooting tool for verifying network connectivity. ping is useful in 
verifying that the remote device is reachable and finding out if there is any packet loss from 
the source to the destination and back. Also, ping will show the network delays for that mo- 
ment in time. 


C:\Users\todd>ping 8.8.8.8 
Pinging 8.8.8.8 with 32 bytes of data: 
Reply from 8.8.8.8: bytes=32 time=177ms TTL=53 
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Reply from 8.8.8.8: bytes=32 time=9ms TTL=53 

Reply from 8.8.8.8: bytes=32 time=9ms TTL=53 

Reply from 8.8.8.8: bytes=32 time=9ms TTL=53 

Ping statistics for 8.8.8.8: 

Packets: Sent = 4, Received = 4, Lost = © (0% loss), 
Approximate round trip times in milli-seconds: 
Minimum = 9ms, Maximum = 177ms, Average = 51ms 


route 


The route command-line utility shown in the following example can assist you in trouble- 
shooting network reachability issues. Use this utility when troubleshooting to look at a local 
workstation’s or server’s local routing tables. This is local to the device only and does not 
give you visibility into the actual network routing table. 


C:\Users\todd>route print 


Active Routes: 


Network Destination Netmask Gateway Interface Metric 
0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.90 20 
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 
192.168.1.0 255.255.255.0 On-link 192.168.1.90 276 
192.168.1.90 255.255.255.255 On-link 192.168.1.90 276 
192.168.1.255 255:255:255,255 On-link 192.168.1.90 276 
192.168.74.0 255.255.255.0 On-link 192.168.74.1 276 
192.168.74.1 255.255.255.255 On-link 192.168.74.1 276 
192.168.74.255 255.255.255.255 On-link 192.168.74.1 276 
192.168.223.0 255.255.255.0 On-link 192.168.223.1 276 
192.168.223.1 255.255.255.255 On-link 192.168.223.1 276 
192.168.223.255 255.255.255.255 On-link 192.168.223.1 276 
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 
224.0.0.0 240.0.0.0 On-link 192.168.74.1 276 
224.0.0.0 240.0.0.0 On-link 192.168.223.1 276 
224.0.0.0 240.0.0.0 On-link 192.168.1.90 276 


255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 
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255.255.255.255 255.255.255.255 On-link 192.168.74.1 276 
2555255 .255.255 255.255.255.255 On-link 192.168.223.1 276 
255.255.255.255 255.255.255.255 On-link 192.168.1.90 276 


Persistent Routes: 
None 


SSH 


Secure Shell (SSH) is the encrypted version of the Telnet protocol and is used to access re- 
mote devices using a command-line interface. 

SSH, Secure Copy Protocol (SCP), and Secure File Transfer Protocol (SFTP) all use port 
22 for communications. Notice that having several applications sharing the same port 
number is acceptable. SSH terminal applications are widely used access remote systems’ 
command interfaces. SSH has replaced the insecure Telnet application because SSH offers 
an encrypted network connection. It is strongly recommended that you use SSH and avoid 
using Telnet. 


Sssh todd@192.168.1.23 


Telnet 


Telnet is a virtual terminal application that allows for command-line logins to a remote de- 
vice. The Telnet application will allow you to log into remote servers or network gear in the 
cloud as if you are locally connected to your laptop or server. 

Telnet is an industry-standard application, and while still used, it is not secure in that all 
commands, including your username and password, are sent over the network in the clear, 
unencrypted. Because of this limitation, the SSH application, which sends and receives 
encrypted data, has largely replaced Telnet. Here’s an example of logging into a remotely 
located network switch using Telnet: 


telnet 192.168.1.251 
User Access Verification 
Username: cloudplus 
Password: 

Core_rtr_a> 


tcpdump 


tcpdump allows a Linux system to capture live network traffic and is useful in monitor- 
ing and troubleshooting. Sometimes called sniffing, tcpdump allows you to set up filters to 
select the traffic you are interested in capturing for troubleshooting. Think of tcpdump as a 
command-line network analyzer. 


$tcpdump -v -n 
tcpdump: listening on ethO, link-type EN10MB (Ethernet), capture size 65535 bytes 
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16:43:13.058660 IP (tos 0x20, ttl 54, id 50249, offset 0, flags [DF], proto TCP (6), length 40) 


64.41.140.209.5222 > 192.168.1.101.35783: Flags [.], cksum @x6d32 (correct), ack 1617156745, 
win 9648, length 


© 


16:43:13.214621 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 
192.168.1.101 > 173.194.36.6: ICMP echo request, id 19941, seq 1659, length 64 

16:43:13.355334 IP (tos 0x20, ttl 54, id 48656, offset 0, flags [none], proto ICMP (1), length 84) 
173.194.36.6 > 192.168.1.101: ICMP echo reply, id 19941, seq 1659, length 64 

16:43:13.355719 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 71) 
192.168.1.101.22181 > 218.248.255.163.53: 28650+ PTR? 6.36.194.173.in-addr.arpa. (43) 





16:43:13.362941 IP (tos 0x0, ttl 251, id 63454, offset 0, flags [DF], proto UDP (17), length 223) 


218.248.255.163.53 > 192.168.1.101.22181: 28650 1/4/2 6.36.194.173.in-addr.arpa. 
PTR bom04s01-in-f6.1e100.net. (195) 


16:43:13.880338 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.3 tell 192.168.1.101, 
length 28 











16:43:14.215904 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 
192.168.1.101 > 173.194.36.6: ICMP echo request, id 19941, seq 1660, length 64 


tracert/traceroute 


The tracert/traceroute utilities are useful for network path troubleshooting. The traceroute 
utility displays the routed path a packet of data takes from source to destination. You can 
use it to determine whether routing is working as expected or whether there is a route failure 
in the path. In the following code snippet, a traceroute command details the path taken 
out of the local network and across the Internet, along with the latency for each router hop 
taken to a remote destination. If a DNS name is associated with the IP address, the 
traceroute utility can resolve the IP address to help you identify the device that the trace 
utility is taking. 

For Microsoft products, the command-line utility is tracert, and the traceroute 
command is used for Linux operating systems. 


C:\Users\todd>tracert 8.8.8.8 
Tracing route to google-public-dns-a.google.com [8.8.8.8] over a maximum of 30 hops: 


1 1 ms 1 ms 1 ms dsldevice.attlocal.net [192.168.1.254] 
2 172 ms 49 ms 7 ms 108-218-244-1.lightspeed.austtx.sbcglobal.net 
[108.218.244.1] 
3 4 ms 5 ms 3 ms 71.149.77.70 
5 ms 3 ms 3 ms 75.8.128.140 
4 ms 5 ms 6 ms 12.81.225.241 
9 ms 9 ms 9ms 12.122.85.197 


61 ms 59 ms 58 ms 206.121.120.66 
9 ms 9 ms 9 ms 216.239.54.109 


© N OURA 
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9 12 ms 11 ms 11 ms 72.14.234.145 
10 11 ms 9 ms 9 ms google-public-dns-a.google.com [8.8.8.8] 
Trace complete 


This is an example of traceroute with Linux: 


$ traceroute google.com 

traceroute to google.com (74.125.236.132), 30 hops max, 60 byte packets 
118.26.54.19 (118.26.54.19) 89.174 ms 89.094 ms 89.054 ms 

182.56.49.175 ( 182.56.49.175) 109.037 ms 108.994 ms 108.963 ms 
16.178.22.165 (16.178.22.165) 108.937 ms 121.322 ms 121.300 ms 

* 119.255.128.45 (119.255.128.45) 113.754 ms 113.692 ms 

72.14.212.118 (72.14.212.118) 123.585 ms 123.558 ms 123.527 ms 
72.14.232.202 (72.14.232.202) 123.499 ms 123.475 ms 143.523 ms 
216.239.48.179 (216.239.48.179) 143.503 ms 95.106 ms 95.026 ms 
bom@3s02-in-f4.1e100.net (74.125.236.132) 94.980 ms 104.989 ms 104.954 ms 


oN on KR WN 


Remote Access Tools 


When troubleshooting networks, it is not common that you will be directly in front of the 
equipment given that devices tend to be geographically dispersed and housed in secure 
locations. However, it is a common practice to connect to, log in, and access networks 
remotely. Common approaches include remotely connecting to a terminal server in the 
data center and logging into devices or using a standard web browser for HTTP access 
as most devices now have web-based consoles. Windows-based systems can be managed 
with the remote desktop utilities. Command-line interfaces are prevalent in most servers, 
security, and network systems. The secure remote access method to the CLI is to use the 
SHH server. 

Each of these will be investigated in more detail next. 


Console Port 


Console ports are common in networking environments and are used to configure switches 
and routers from a command-line interface (CLI). Linux servers also use the console or se- 
rial ports for CLI access. In a data center, devices called terminal servers are deployed that 
have several serial ports, each cabled to a console port on a device that is being managed, 
as shown in Figure 10.2. This allows you to make an SSH or a Telnet connection to the ter- 
minal server and then use the serial interfaces to access the console ports on the devices you 
want to connect to. Also, a VM can use port redirections to connect to a physical serial port 
on the server for console connections. 
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FIGURE 10.2 Console port access 
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Probably the most common and easiest way of managing remote devices is to use a standard 
web browser and access the remote device’s web interface, as illustrated in Figure 10.3. When 
connected and authenticated, the web-based applications allow for a graphical interface that 


can be used to monitor and configure a device. 


FIGURE 10.3 Console port access 
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There has been a trend to move away from client applications that need to be installed 
on the local workstation and move everything to a web interface for ease of use. It is also 
common to use a web browser to connect to a hypervisor, virtual machine, or network 
device and then download and install the management application. HTTPS, which uses 
TCP port 443, is the suggested remote access protocol for web-based access since it is 
secure. The nonencrypted HTTP port 80 is rarely supported because of its lack of security. 


RDP 


The Remote Desktop Protocol (RDP) allows remote access to Windows devices. Microsoft 
calls the application Remote Desktop Service and in the past has called it Terminal Services. 
RDP is a client-server application, which means RDP has to be installed and running on 
both the server and the local workstation you are using to access the cloud server. The desk- 
top application comes preinstalled on most versions of Windows. 

Figure 10.4 shows a local computer running the RDP application to remotely access a 
cloud Windows server graphical interface. 


FIGURE 10.4 _ Local computer running the RDP application to remotely access a cloud 
with a Windows server graphical interface 
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The graphical client will request the name of the remote server in the cloud, and once 
connected, you will be presented with a standard Windows interface to log into. Then you 
will see the standard Windows desktop of the remote server on your local workstation. 

RDP is invaluable for managing remote Windows virtual machines since it allows you to 
work remotely as if you were locally connected to the server. 


SSH 


SSH is commonly used as a remote access utility for command-line access. The ability to 
support encryption and its widespread use across many different types of products and 
services makes it a popular application. As you learned above, the Secure Shell protocol has 
largely replaced Telnet as a remote access method. SSH supports encryption, whereas Telnet 
does not, making Telnet insecure and largely obsolete. To use SSH, the SSH service must be 
supported on the server or device in the cloud data center and enabled. This is pretty much 
standard on any Linux distribution, router, firewall, load balancer, or switch and SSH can 
also be installed on Windows devices. 
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Many SSH clients are available on the market, both commercial software and free of 
charge in the public domain. The SSH client connects over the network using TCP port 22 
over an encrypted connection, as shown in Figure 10.5. Once you are connected, you have 
a command-line interface to manage your cloud services. SSH is a common remote connec- 
tion method used to configure network devices such as switches and routers. 


FIGURE 10.5 Secure Shell-encrypted remote access 
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Troubleshooting Security Issues 


In this section, you will learn about troubleshooting security-related issues in the cloud. I will 
discuss the most common problems you will find as a cloud customer and give you insight 
into how to begin troubleshooting them. 

Keep in mind that the cloud provider will be responsible for the security of the underly- 
ing infrastructure, and you will take responsibility for the “top of the stack.” This will 
include the security posture of your cloud deployments. You will learn about security 
maintenance in troubleshooting as it relates to user accounts, sign-on issues, authentication, 
authorization, device hardening, and digital certificates. 


Account Privilege Escalation 


Privilege escalation can be defined as a user receiving account privileges that they are not 
allowed to possess. A storage administrator in your cloud deployment usually would not be 
granted full control over the firewalls, for example. If they were able to gain firewall con- 
figuration attributes, that would be an example of privilege escalation. Privilege escalation 
can occur because of a bug, a design oversight, or delegating user account management to a 
person who is willing to change user account settings without gaining necessary approvals. 
Figure 10.6 illustrates the account privilege escalation pyramid. 

Operating systems are designed to support multiple users and support multiple accounts. 
It is a critical security issue to grant users access privileges to the level required for them to 
perform their duties but not in addition to what they need. When troubleshooting privilege 
escalation issues, check for up-to-date antivirus software, that the applications are running 
with the least privileges required for them to operate, and that, if possible, kernel appli- 
cations are digitally signed. Also make sure you have configured security for mandatory 
access controls, as discussed in Chapter 3. 
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FIGURE 10.6 Account privilege escalation 
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Signing in to remote resources in the cloud has many dependencies. Access control lists and 
firewalls must be configured to allow you to access a cloud service with its destination IP 
address and port number. Often, for additional security, the source IP range from your office 
is added to the security rules, and if you are not connecting from that specific location (range 
of IP addresses), you will be denied access. Many cloud providers have device-level security 
groups that block incoming traffic unless it is specifically configured to allow the connection. 

Account sign-in management may require two-factor or biometric authentications, 
which I will discuss next. 






Sign-On Issues 


Authentication 


To review from Chapter 2, authentication is the ability to identify who a user is, usually 
during the login process. Users and devices can be authenticated using a wide variety of 
methods. However, the most common is the standard method of a username and password. 
Other methods include Multi-Factor Authentication (MFA) tokens and biometrics such as 
fingerprint or iris scanners. 

When troubleshooting authentication issues, the most valuable source of information 
will be in the logging files. When authentication fails, a log file will be generated and infor- 
mation included on the reason for the failure. Accounts can be disabled and passwords 
expired. Also, if the user fails after the defined number of password attempts, most systems 
will lock the user out, and they will not be allowed to log in. 


Authorization 


Once a user is authenticated, or logged into a system, they are granted or authorized rights 
to resources on that system. It is common that when a user is created, they are authorized 
to access few, if any, services. The systems administrator must grant access to each user by 
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explicitly assigning authorizations to the account or placing that user into a group that has 
authorization. 

When troubleshooting authorization issues, it is best to check the user’s account configu- 
ration to see whether they are assigned to the required groups or have direct object autho- 
rization. Also, logging will generate records for every successful and failed authorization 
activity. 


Confederations 


Instead of managing a separate database of cloud users, federations can be used to access 
your on-premise user accounts such as those in Active Directory. Confederations save a lot 
of administrative work and serve to consolidate user permissions into a central repository. 
Most cloud providers offer different options to connect the cloud to these already existing 
user accounts. While each implementation will be different, you should closely follow the 
cloud provider’s documentation or, if available, wizards. Once the federation connection 

is made, there should be monitoring and logging data available on the health of the con- 
nection. When troubleshooting federation problems, you will most likely need to get your 
internal directory services team involved to get visibility on both ends of the connection. 


Certificate Configuration Issues 


As discussed in Chapter 9, it is important to keep security certificates up-to-date and not 
expired. Keep track of all certificate expiration dates and renew them prior to expiration! 

Certificate management can be a complex and wide-ranging topic. In cloud computing, 
there are many different types of certificates and a variety of services offerings that range 
from your organization having complete control of the security certificates to mixed offer- 
ings to the cloud provider taking responsibility for certificate management. 

Troubleshooting will be dependent on your key management plan. As usual, review 
log files, collect and distill the information you have collected, and plan your approach to 
troubleshooting certificate issues. Oh, and check the expiration date! 


Device-Hardening Settings 


To prevent intrusions and hacks, all devices must be hardened from attacks. These processes 
can be rather extensive and are specific to the device or service. It is suggested that you follow 
the vendor or cloud provider’s best practices on hardening each specific device or service. The 
best practices are usually published on the support websites or offered as white papers. 

Follow the hardening procedures exactly as outlined, and do not hesitate to contact the 
document publisher should you have any questions. This is not where you want to guess or 
make assumptions! 

After the hardening process has been completed, you must validate the configurations. 
Here, it is suggested that you consider contracting a third-party security testing company 
for impartial validation services. 
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External Attacks 


It is common for cloud providers to provide first-level external attack protection since they 
control the cloud network resources. This will include denial-of-service and scanning attacks, 
to name a few. However, cloud providers cannot be responsible for preventing all attacks. 
Your monitoring systems should show anomalies away from your baseline. Many firewall 
systems also have the intelligence to recognize an attack and take measures to block and 
mitigate them. As this is occurring, you, or your monitoring systems, have access to the at- 
tack log data that should provide invaluable information about troubleshooting the attack. 

There are security companies, government agencies, large carriers, and network opera- 
tors that will publish “Internet health dashboards” that you can check to see the scope of 
the intrusion. 


Identifying Weak or Obsolete Security Technologies 


As part of your ongoing operations management practice, your cloud team should regularly 
evaluate the state of the security market and offerings. It is truly amazing how fast cloud 
technologies are developed and introduced to the marketplace. As the technologies are con- 
tinuously being improved, by definition, many existing technologies become obsolete or do 
not have the critical feature sets the newer offerings have. It is critical that you follow devel- 
opments offered in white papers, blogs, vendor announcements, conferences, communities of 
interest, and any other outlet to keep abreast of cloud security offerings and implement those 
that offer benefits to your organization. 


Internal Attacks 


Social engineering is the most predominate internal attack where someone is tricked into 
providing credentials or holding a door open into a secure data center, for example. Training 
seems to be ongoing to educate the workforce on common tracks to obtain information or 
access using social engineering. Use common sense and always be a bit suspicious if someone 
asks you to do something you do not feel comfortable with or seems out of the ordinary. 

Servers can be initiated inside the security perimeter and can be configured to capture 
data, scan the network, or masquerade as another system. Most cloud provider security 
operations will shut down a device that is doing a port scan of their infrastructure. Cloud 
systems monitor for intrusion detection and prevention, taking the needed actions to 
mitigate the threat. 


Maintain Sufficient Security Controls and Processes 


The cloud provider will most certainly have a dedicated security department that encom- 
passes not only security from a technology standpoint but also physical security. 

Security practices are critical to avoid breaches and to keep in front of those who want 
to damage you or your company’s reputation. 


314 Chapter 10 = Troubleshooting Networking and Security Issues 


As part of an effective and complete cloud operation, your company should develop and 
document your security posture and controls. This should be part of your regular opera- 
tions documentation and project updates. 

The concept of least privilege is important as it only grants security permissions for what 
is actually required and nothing additional. Division of duties is common where there is no 
one single person who has end-to-end access responsibility. With the division of duties, a 
single individual cannot take control because there is a second person who has access to a 
critical part of the cloud that the other does not possess but needs to complete the role. 

Security processes and controls are large topics that are rapidly evolving. CompTIA 
offers separate education tracks on security. 


Network Access Tunneling and Encryption 


When interconnecting networks, especially over a public network such as the Internet, it is 
mandatory that you encrypt all traffic from the source to the destination. 

Encryption can be a complex topic, as you have learned throughout this book. Use the 
most current encryption types and transforms such as AES-256 to protect your data. Cloud 
providers commonly offer encrypted VPN connections from your facility to your cloud fleet 
of services. Use their best practices and follow the guidelines that they publish online. You 
will need this information when configuring and testing a VPN connection. Sometimes the 
terminology can be confusing. It is mandatory that you read the manual to make this work! 


Physical Access, Infrastructure, and Availability 


It is a standard policy that there be no data center access unless there is an explicit need 

to gain entrance. Cloud providers do not make it a practice to let visitors into their data 
centers. If there is a need to access the data center for vendor support, an approval process 
usually takes place, and if approved, access is granted for a time window that usually is dur- 
ing a change window. 

When arriving at a cloud facility, you will be asked to provide identification and pos- 
sibly a trouble or work ticket. You may have to undergo a search of your possessions that 
you intend to take into the data center. If you are not a regular employee, you will probably 
need to be escorted when inside the data center. 

Data centers have elaborate security measures including locked sections and extensive 
video monitoring systems. Yes, you are being watched. 

Cloud data centers are highly secure and often hidden away in nondescript buildings 
with no company logos. However, the power substations nearby, security fences, cameras, 
and security stations are usually a giveaway! 

One trade-off is between security and safety. For example, how should security systems 
default in the event of a power failure? Should locked doors default to an unlocked state if 
there is no power? This would allow for a quick exit of personnel and avoid the possibility 
of being trapped in the data center in the event of an emergency. Most times, safety will 
supersede security in an emergency. 
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Unencrypted Communications and Data 


Data sent across a network unencrypted is susceptible to interception and allows an attacker 
easy access to your data because all the information will be in clear text. For example, using 
Telnet for remote command-line access exposes your username and password credentials 

to anyone with a network sniffer and the ability to connect to your network. If you must 
conform to regulatory requirements such as HIPPA, SOX, or PCI regulations in the United 
States or to meet corporate security directives, you will need to replace these older systems 
with current, more secure applications. Telnet has been replaced with Secure Shell (SSH). 
FTP has a secure version called SFTP. Web browsers support the unsecure HTTP protocol 
and the SSL/TLS protocol commonly referred to as HTTPS. 

Remote network connections use VPNs that are encrypted with IPsec or other encryp- 
tion architectures. Secure systems can be difficult to troubleshoot as the data is, by defini- 
tion, encrypted and offers minimal insight on any issues it may be experiencing. Log files 
can be useful when troubleshooting encrypted systems as they are readable in plain english 
and, if consolidated, offer insight on both ends of the link. 


Troubleshooting Methodology 


Network systems can develop operational problems from many sources including configura- 
tion errors, software bugs, hardware failure, human error, traffic patterns (a malicious attack 
or network saturation), and others. 

To effectively resolve technical issues, you should have a solid plan of action and follow 
a formalized approach to troubleshooting. By following a structured plan to your trouble- 
shooting, you will be much more effective than just searching all over the network looking 
for the problem. Fortunately, there are multiple standard approaches to choose from. 

Troubleshooting is the process of diagnosing the cause of an impairment and resolving 
the issue. The ideal situation is that the monitoring and reporting systems will trigger an 
alarm if there is an impairment and, using either automation or the expertise of the cloud 
support staff, will resolve the issue prior to there being any impact on operations. So, when 
you are called upon to resolve a problem, it is important that you be prepared with a well- 
thought-out methodology for troubleshooting. 

The troubleshooting process includes collecting and analyzing data, eliminating irrele- 
vant data, creating a hypothesis of what the problem may be, testing that assumption, and, 
after the issue has been identified, resolving it. To effectively perform troubleshooting, a 
logical and structured approach is mandatory. Without any structure, much time is wasted 
searching in a seemingly random fashion that does not allow for a logical collection of facts 
that can be used to resolve the issue. Using a haphazard approach may resolve the problem 
but does not lead to an effective explanation as your troubleshooting approach was very 
confusing! You may not be able to recall what you tested, when, and in what order. Basically, 
you will lose track of what affected what. This makes it hard to provide feedback and 
document steps to prevent the issue from recurring in the future. A structured approach 
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allows you to reduce duplicate troubleshooting steps and ensures you do not skip any steps 
and are able to effectively update others about the potential issues you have eliminated and 
what still needs to be investigated. 

This is not to say that experienced troubleshooters may, to quickly resolve the problem, 
bypass a structured approach and, using past experience, go directly to the problem. This 
approach works if the assumptions are correct. If they are in error, then valuable time may 
have been wasted. 

There are many structured troubleshooting methods, with many being variations or 
combination of others. The most common are top-down, bottom-up, divide-and-conquer, 
follow the path, configuration comparisons, and device swapping. 

Of these, the first three are the most common. The top-down approach references the 
Open Systems Interconnection (OSI) model, starting at the application layer and working 
downward until the problem is identified. Using application-level utilities, such as the ones 
explained earlier in this chapter like ping, traceroute, and others, you can work your way 
down the stack, as shown in Figure 10.7. 


FIGURE 10.7 Top-down troubleshooting approach 
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The authors prefer the bottom-up approach shown in Figure 10.8. Since the upper layers 
of the OSI model are dependent on the lower layers being operational, it is logical to inves- 
tigate the lower parts of the network and work your way up to the applications. 























FIGURE 10.8 Bottom-up troubleshooting approach 
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Divide-and-conquer is a variation of top-down and bottom-up where you start in the 
middle of the OSI model, say at the transport layer, and based on your testing results, either 
work up the stack or down, as shown in Figure 10.9. 


FIGURE 10.9 Divide-and-conquer troubleshooting approach 
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Another effective method to use when troubleshooting network issues is to follow the 
traffic path until you reach the failure point. Utilities such as ping and traceroute will be 
helpful when implementing this approach. 

Configuration comparisons may be helpful in determining whether a change was made 
to the network that caused the issue under investigation. Cloud companies offer configura- 
tion backup services that allow you to go back and see what the last good configuration 
was and view change log reports. Also, as a last resort, you may want to swap cables, 
switch ports, switches, and so forth, to see whether a physical device is the issue without 
spending time in the console looking at interface statistics. 


Corporate Policies, Procedures, and the Impact 
of Implementing Changes 


Chapter 2 covered the subject of change management and corporate policies that are in place 
to ensure that there is a structure to the change process, with the intent of reducing the risk 
of implementing changes. 

To review, change management is the process of managing all aspects of ongoing 
upgrades, repairs, and reconfigurations. Change management involves planning and man- 
aging changes to minimize any disruptions of service. 

Change management outlines policies and procedures and provides a standardized pro- 
cess to follow, including the following: 


= Recording the change 

= Planning for the change 
= Testing documentation 
= Getting approvals 


» Evaluating 
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= Validating 
= Compiling instructions for backing out the change 
=a Doing a post-change review if desired 


The process of managing technical configuration and customization changes can be 
detailed in large data center or cloud operations. A change management procedure usu- 
ally includes the name of the requester, what the change is going to be, and the reason or 
justification for making the change. Other areas include a description of the expected result 
of making the change and what risks are involved. You must also outline what resources 
will be needed and coordinate the activities of the various groups involved in the change. 

A list of individuals responsible for the various aspects of the change including the design, 
configuration, deployment, and validation steps must be prepared. There also needs to be 
an investigation into other changes that are taking place to make sure no conflicts exist 
between those changes and yours. Also, if one change requires another change to take place 
before it can be implemented, the change sequences will have to be coordinated. 


Steps to Identify the Problem 


When a problem arises, the logging system’s data and user descriptions can vary widely 

and not always provide an accurate description of the problem (usually just the symptoms). 
However, the information can act as a pointer to where the real issue may reside. Your 
responsibility is to clearly define the problem based on your initial investigation and outside 
information provided. 


Gather Information 


Trouble reports may not always be informative and are reflections of what is known at 
that point in time. It is the responsibility of the troubleshooter to gather as much informa- 
tion as possible to get the big picture and look for clues of the problem. Impacted users and 
monitoring tools are prime data sources. Also, the cloud provider’s health dashboard offers 
insight into their internal operations. Many Internet support boards give affected groups a 
collaboration point, such as chat rooms or forums to discuss and collect data. 

Companies may implement a war room where all groups can gather and work together 
on a problem. There are many instances where the information that needs to be gathered 
falls under multiple areas of responsibility (or as they are sometimes called, silos). The war 
room allows the different groups to interact with each other to gather the required data and 
consolidate the information into one area. 


Distill the Issue 


After gathering information on the issue, the next step is to analyze the information for clues 
as to what may be causing the problem. Keep an open mind and look for patterns in the 
data or values that do not appear to be in the benchmark ranges. If you identify an anomaly, 
ask yourself if this may be the problem or if it is possibly the result of a problem elsewhere 
that is affecting this component. You may need to gather additional information as you work 
to distill the cause of the issue to validate the information you have gathered. 
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During this process, look for symptoms or indicators that may point to the underlying 
cause of the problem. Also, look for evidence that eliminates areas that could have been 
part of the issue. The troubleshooting process should include comparing what should be 
occurring to what is actually occurring. It is important to know this because it will lead 
you to identify the problem. Compare the data with the baseline to determine the delta 
between when the device was functioning properly and the current object values. 

In this step, you may need to research the suspected issue. This includes eliminating poten- 
tial causes and forming conclusions from the collected data. It is important to always challenge 
your conclusions to make sure you are not misinterpreting the data and symptoms reported. 


Research 


After you have distilled the issue, the next step is to research the data and create a hypoth- 
esis of the underlying issue to test against. Look at all available resources to validate that 
reported issue and the steps available to resolve it. 


Create a Plan of Action 


After you have collected the information, distilled the data down to identify where the prob- 
lem resides, and researched the issue, the next step is to create an action plan to resolve the 
issue. The actions required to test and resolve the issue may be out of your area of control, 
and working with different internal groups such as the storage, networking, or virtualization 
teams will be required. Additionally, you may need to contact the cloud vendor’s support 
group and open a troubleshooting ticket for assistance. 

Determine what steps to take to resolve the issue. For instance, you may make a setting 
change, test the results, and, if necessary, remove the change. The process of troubleshoot- 
ing processes and testing will continue until the issue is resolved. 


Test and Verify 


After you have a solid plan of action, the next step is to implement the plan and test to verify 
the results. It is extremely important to document the steps taken and the results observed as 
you go through this process. This will help you to follow what has been tested and what has 
not. This data is also valuable for documenting the incident upon resolution. 

Continue through the testing and validation process until problem resolution. If you 
exhaust all possibilities, you may need to open a trouble ticket with the cloud vendor or 
other third parties that may be of assistance. 


Document and Resolve 


After the issue has been resolved, it is helpful to document your findings so that, should the 
issue return, you have historical information on how to troubleshoot and resolve the incident. 
As part of the resolution process, it is important to communicate to the user community, 
or appropriate parties, that the issue has been resolved. This can be accomplished by updat- 
ing a status dashboard or sending an update to a group e-mail address, for example. 
Documentation also includes backing up the configurations if necessary. If you made 
any changes to a device configuration, add what was changed and why the change was 
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made to resolve the issue in your documentation and then back up the actual configuration 
to a server as an archive. 


Summary 


This chapter covered troubleshooting from a networking perspective. You were introduced 
to many of the common networking issues you will find in the field including IP addressing 
issues such as subnetting, routing, and gateway configurations. Troubleshooting DNS, QoS, 
VLAN/VXLAN, firewall configurations, network latency, MTU, and proxies were all intro- 
duced and discussed. 

There are many utilities offered for both the Windows and Linux operating systems that 
are invaluable aids in troubleshooting networking problems. The primary tools are ping, 
tracert/traceroute, telnet, netstat, nslookup/dig, ipconfig/ifconfig, route, arp, ssh, 
and tcpdump. We gave use cases and showed the text output to help you understand how to 
use these critical tools when troubleshooting network problems. 

Since the cloud is usually at a remote facility, there are different methods to access these 
resources from your location. The common tools used are SSH, HTTP, RDP, terminal serv- 
ers, and Telnet. 

Troubleshooting account issues is common, so you learned about what to look for when 
working on sign-on, authentication, authorization, and confederation problems. Privilege 
escalation and role changes were also included in this section. 

Troubleshooting security issues includes dealing with certificates, encrypted communica- 
tions, security hardening, and physical facility access; keeping your security technologies 
up-to-date by following new developments; and assessing your security posture to new 
offerings on the market. 

The chapter ended with a general overview of troubleshooting and some of the different 
troubleshooting models that can be used, such as top-down, bottom-up, and divide-and- 
conquer. Then you learned about additional troubleshooting processes to follow for effec- 
tive and timely resolution of the issue. 

A troubleshooting methodology includes identifying the problem, establishing a theory 
of the probable cause, and testing the theory to determine its cause. Then you establish a 
plan of action to resolve the problem and implement the solution. After these steps, verify 
full functionality; finally, you should document the findings, actions, and outcomes. 


Exam Essentials 


Know the various network connectivity issues and how to troubleshoot them. Common 
network issues that you can expect to be tested on include IP addressing such as incorrectly 
defined subnet masks, default gateway configurations, errors in routing, and DNS configurations. 
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Know at a basic level what QoS is and the symptoms of network saturation. Be able to iden- 
tify what the actual problem is for the exam. For example, poor network performance would 
point to a latency or QoS issue, and if the question is about a failure to connect to a remote 
site using its domain name, it would be a DNS problem. 


Know how to identify networking issues. There may be questions on network traffic 
not being able to make it to its destination where you need to identify the network issue. 
This can include using command-line troubleshooting tools, investigating log files, and 
monitoring systems to gather information on the reported issue. There may be a long 
scenario where you are given a large amount of detail, and you should be able to discard 
what does not apply and select from the answers given the core processes to identify the 
problem. 


Differentiate user account issues. You may see questions on the exam with a description of 
a user not being able to access the cloud and a brief explanation of the symptoms. You need 
to be able to distill the problem to common user issues such as account lockouts, authentica- 
tion and authorization problems, and account federation problems. 


Describe the process of identifying certificate problems. Know that security certificates 
have expiration dates and that you need to renew them prior to that time. Certificate man- 
agement can be a fully managed cloud service or handled internally by your organization. 
You may be asked what steps to take when troubleshooting a certificate problem and be able 
to identify the correct answer offered given the scenario. 


Identify network attacks. You may be given an example of a network attack, and you 
should be able to identify whether it is originating internally or externally. 


Explain remote access technologies and uses. Know how to access the cloud remotely. 
Vendor management utilities—such as the Remote Desktop Protocol, which is com- 
monly used for remote server administration—are available for remote hypervisor access. 
Remote command-line access uses the Secure Shell protocol because it is encrypted and 
more secure than Telnet. Console ports are used for command-line serial port access for 
remote configuration and monitoring. Many devices offer a web-based configuration 
interface that can be accessed using the HTTP protocol much like accessing websites on 
the Internet. 


Summarize the various approaches to troubleshooting. Troubleshooting methods include 
top-down, bottom-up, and divide and conquer. 


Know how to use a troubleshooting methodology. You may be presented with a question 
where a description is given of a troubleshooting step and then asked to identify which step 
in the troubleshooting process is being used. Examples are identifying the problem, establish- 
ing a theory of the probable cause, testing the theory to determine its cause, establishing a 
plan of action to resolve the problem, and implementing the solution. The final step is docu- 
menting the findings, actions, and outcomes. 
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Written Lab 


Fill in the blanks for the questions provided in the written lab. You can find the answers to 
the written labs in Appendix B. 


1. When a network becomes saturated, _________ can be implemented to define 
priorities. 


An Ethernet frame larger than the standard size is a 





A ____is a device that is inserted into the middle of a traffic flow and terminates 
connections in both directions and monitors traffic between the source and the 
destination. 


4. Hyperscale cloud data centers implement _________ overlays to extend cloud customer 
private segments to more than 16 million networks. 


5. The network utility is found in both Windows and Linux operating systems 
and is used to show what network connections are open to remote applications. 


6. Both the Linux and the Windows utilities query a DNS system, giving a 
domain name and receiving the corresponding IP address. 








7. When the cloud issue has been resolved, the final step in the troubleshooting process is 
to provide resolution 


8. After you have distilled the issue, the next step is to ______ the data and create a 
hypothesis of the underlying issue to test against. Look at all the available resources to 
validate the reported issue and the steps available to resolve it. 


9. Social engineering is the most predominate _________ attack where someone is 
tricked into providing credentials or holding a door open into a secure data center, for 
example. 

10. can be defined as a user receiving account privileges that they are 





not allowed to possess. 


Review Questions 323 


Review Questions 


The following questions are designed to test your understanding of this chapter’s material. 
You can find the answers to the questions in Appendix A. For more information on how to 
obtain additional questions, please see this book’s Introduction. 


1. Carrie is researching various remote access options to access her Linux servers in a public 
cloud. She has been asked to provide a standardized and secure solution that protects 
against snooping. As a Cloud+ architect, you have been asked to assist. What protocol 
would you advise she implement? 


A. RDP 

B. Telnet 

C. IPsec 

D. SSH 

E. Terminal server 


2. James is troubleshooting a DNS issue and wants to look at DNS frames being sent and 
received from his network adapter card on a web server. What utility would he use to 
collect the traces? 


A. dig 

B. netstat 
C. tcpdump 
D. nslookup 


3. An intern at your company is asking about the mappings between the layer 2 MAC address 
and the gateway router. He wants to verify that the VM has the correct network mapping 
information. Which utility would you tell him to use to gather this information? 


A. dig 

B. ipconfig 
C. arp 

D. netstat 


4. Sharon is unable to reach her Linux-based web server hosted in the Singapore zone of the 
cloud. She is located in Austin, Texas. What utility can she use to verify the connection 


path? 

A. traceroute 
B. ipconfig 

C. arp 

D. netstat 

E. ping 

F. tcpdump 

G. route print 


324 


Chapter 10 = Troubleshooting Networking and Security Issues 


Connie is documenting different methods that her remote operations center can use to 
access the Calgary fleet of servers operating in a community cloud. Which of the following 
are not viable methods? (Choose two.) 


RDP 

Telnet 

IDS/IPS 
Terminal server 
DNS 

HTTP 


™moOO wD 


Allison is in the process of migrating graphical vendor management utilities away from 
locally installed applications on her desktop and to an approach that does not require any 
local installations and will be easier to implement and use. What approach would meet 
these requirements? 


A. Java 
B. CSS 
C. Web 
D. RDP 
E. SSH 


The remote disaster recovery location follows the warm site model. To configure the 
network switches, routers, and firewalls remotely, Mark will need serial port access from 
his company’s operations center. He has 14 serial ports currently but needs to be prepared 
for any unplanned expansion requirements during a disaster recover cutover. What device 
would you recommend he implement at the warm site? 


A. RDP 

B. Telnet 

C. IPsec 

D. SSH 

E. Terminal server 


Sarah manages user accounts for her company’s cloud presence. She has a trouble ticket 
open with Jill to assist her in accessing an SSD storage volume in the San Paulo region of 
the public cloud. What kind of user issue is she investigating? 


A. Authentication 
B. Authorization 
C. Federation 

D. SSO 


10. 


11. 


12. 
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Harold is getting alarms from the public cloud’s application load balancer about security 
failures. Harold reviews his problem resolution documentation to investigate, and there 
have been no troubles reported in the past year. The load balancer has been configured to 
offload port 443 web traffic from the backend fleet of web servers. As a Cloud+ consultant 
brought in to assist, what should be the focus of the investigation? 


A. HTTPS 

B. Certificates 
C. IPsec 

D. RDP 

E. ssldump 

F. netstat 


Multiple users are complaining that they cannot access a cloud-based collaboration 
system. The operations center has been investigating and has, so far, verified that the MFA 
applications are operational. What user system are they troubleshooting? 


A. Authentication 

B. Authorization 

C. Federation 

D. SSO 

The backend fleet of web servers is intermittently failing load balancer health checks and 


dropping out of the pool. You are involved in troubleshooting and begin your investigation 
by making sure the web application is operational. What approach are you undertaking? 


A. Top down 
B. Bottom up 
C. Divide and conquer 
D. Evaluation 
E. Validation 


Your web servers have lost communications to the SQL backend database on your 
e-commerce public website. You have been brought in to assist in resolving the problem. 
After reviewing the log files and the monitoring system, you suspect it may be a network- 
related issue. You devise a series of tests that starts with checking the server’s connection to 
the database. What troubleshooting approach are you implementing? 


A. Top down 
B. Bottom up 
C. Divide and conquer 
D. Evaluation 
E. Validation 
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13. 


14. 


15. 


16. 


17. 
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A middleware application running in the cloud is reporting session drops in its log files. 
You need to quickly resolve the issue and get the server back online. You decide to run ping 
and traceroute tests on the server as your first line of troubleshooting. What approach are 
you using? 

Top down 

Bottom up 


A 
B 
C. Divide and conquer 
D. Evaluation 

E 


Validation 


What are common troubleshooting steps? (Choose all that apply.) 
Gather information 

Distill the issue 

Research 


Create a plan of action 


moon D 


Test and verify 


Your cloud provider’s data center is in an industrial park with no company signage, 
extensive video cameras in the parking lot, and biometrics at the guard shack. What type of 
security is the provider implementing? 


A. Building 

B. Device 

C. Infrastructure 

D. Tunneling 

Kelly has picked up a trouble ticket that shows the connection between the Toledo field 


office and the Detroit cloud edge location has dropped. She confirms it is a secure Internet- 
based access solution. What type of connection is this? 


A. Direct peering 


B. IDS 

C. VPN 

D. AES-256 
E. RDP 


Nick is setting up a new fleet of IIS web servers in his IaaS e-commerce site. The company 
has elected to use a hybrid approach and desires graphical connections to the Windows 
bastion hosts. What traffic must he permit through the external-facing firewall to the host? 


A. SSH 
B. RDP 
Cc. DNS 
D. IPS 
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18. Jill logs into her NoSQL database server residing in a private subnet on a public cloud. She 
needs to verify network connectivity with the application tier. What utility can she use as a 
quick connectivity test? 


19. 


20. 


A. 
B. 
C. 
D. 


arproute 
netstat 
tcpdump 
ping 


After deploying a new public website, your validation steps ask you to check the domain 
name to IP address mappings. What utility can you use for validation? (Choose two.) 


moO 8 D 


RDP 

dig 

SSH 
nslookup 
IPsec 

IPS 


Donna logged into her cloud bastion host by making an SSH connection from her 
operations center desktop. She uses the Linux host to connect to other systems in the 
private cloud. She needs to add an access control list rule to allow the bastion server to 
access a new subnet. She needs the source IP address of her host. What command can she 
run on the server to collect this information? 


A. 


B. 
C. 
D 


curl /localhost/metadata/global/interface 
ipconfig 
ifconfig 
netstat 


Answers to Review 
Questions 
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Chapter 1: An Introduction to Cloud 
Computing Configurations and 
Deployments 


1. A. Infrastructure as a Service offers computing hardware, storage, and networking but not 
the operating systems or applications. 


2. C. Resource pooling is the allocation of compute resources into a group, or pool, and then 
these pools are made available to a multitenant cloud environment. 


3. A,C, D. Elements and objects are examples of devices and systems in the cloud. In this 
question, the elements are CPU, memory, and storage. 


4. C. Pooled virtual resources include memory, storage, networking, and CPU. Security is a 
general technology area and not a physical resource that can be pooled. 


5. B,D. One of the prime advantages of cloud-based computing and the automation and 
virtualization it offers in the background is the ability to leverage the rapid provisioning of 
virtual resources to allow for on-demand computing. 


6. A,B, E. Elasticity, on-demand-computing, and pay-as-you-grow are all examples of being 
able to expand cloud compute resources as your needs require. 


7. B. The interconnection of multiple cloud models is referred to as a hybrid cloud. 


8. C. A virtual switch is a software extraction of a physical Ethernet LAN switch that runs 
on a hypervisor and interconnects a VM’s virtual network interface card to the outside, 
physical data network. 


9. B. The pay-as-you-grow cloud characteristic allows billing for only the services used. 


10. A, C, G. It is common practice and strongly encouraged to split operations into different 
and isolated sections of the cloud to prevent interference between development, operations, 
and quality assurance networks. 


11. D. On-demand cloud computing allows the consumer to dynamically add and change 
resources with the use of an online portal. 


12. C. Software as a Service offers cloud-managed applications as well as the underlying 
platform and infrastructure support. 


13. A, E, G, I. Network delays, storage input/output performance, swap file usage, and 
the ability to scale are all examples of cloud performance components. Firewalls and 
encryption are security components, IaaS is a service model, and memory pooling is not 
relevant to the question. 


14. A. Cloud operators segment their operations into regions for customer proximity, 
regulatory compliance, resiliency, and survivability. 


15. 


16. 


17. 


18. 


19. 


20. 
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A, B, D. Prior to performing a cloud migration, baseline measurements, a determination of 
capacity requirements, and complete documentation are all requirements for success. 


C. The shared responsibility model outlines what services and portions of the cloud 
operations the cloud consumer and provider are responsible for. 


C. Penetration testing is the process of testing your cloud access to determine whether there 
is any vulnerability that an attacker could exploit. 


C. Community clouds are offered for a specific community of interest and shared by 
companies with similar requirements for regulatory compliance, security, or policy. 


B. Orchestration platforms automate the provisioning of cloud services and often include a 
self-service dashboard that allows the consumer to manage and deploy cloud services with 

a web browser. The automation used by cloud providers allows for fast deployment of new 

services and applications. 


B. Platform as a Service offers computing hardware, storage, networking, and the 
operating systems but not the application software. 


Chapter 2: Cloud Deployments 


— 


C. A private cloud is used exclusively by a single organization. 


D. A community cloud is used by companies with similar needs such as medical or 
financial services. 


D. Multifactor authentication systems use a token generator as something that you have 
and a PIN/password as something you know. 


B. With asynchronous replication, there will be a delay as the data is copied to the backup 
site and provides eventual consistency as it uses a store-and-forward design. The backup 
storage array is normally several transactions behind the primary. 


C, D. When migrating stored data to the cloud, the two available options are online 
and offline. 


B. When migrating a server that is running on bare metal to a hypervisor-based system, 
you would be performing a physical-to-virtual migration. 


C, E, G. Hypertext Transport Protocol Secure, Secure Shell, and File Transfer Protocol 
Secure all provide encrypted transmission of data. 


B. Obfuscation is a means to complicate or confuse the ability to decipher storage 
information. 


D. A storage area network (SAN) is a high-speed network dedicated to storage transfers 
across a shared network. Block access is not a networking technology. Zoning is for 
restricting LUNs in a SAN, and VMFS is a VMware filesystem. 
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10. 


11. 


12. 


13. 


14. 


15. 


16. 


17. 


18. 


19. 


20. 
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C. Authentication is the term used to describe the process of determining the identity of a 
user or device. 


A, C, E. Application programmable interfaces, command-line interfaces, and GUI-based 
interfaces are all commonly used tools to migrate, monitor, manage, and troubleshoot 
cloud-based resources. 


B, D, F. A virtual machine will consume virtualized resources including virtual RAM, 
virtual CPUs, and memory pools. 


C. Tiering is the process of defining the storage needs of the cloud customer and aligning 
them with the cloud provider’s offerings. RAID is a hardware storage family of redundancy 
types. Multipathing is a redundant SAN technique, and policies are not related to the 
question. 


B. RAID combines physical disks for redundancy and performance. Multipathing is 
a redundancy SAN design, masking is a LUN access process, and tiering is a storage 
hierarchy technique. 


D. RAID S has parity information that is striped across multiple drives that allows the 
drive array to be rebuilt if a single drive in the array fails. The other options do not have 
parity data. 


B. The service level agreement outlines specific metrics and the minimum performance 
provided by the cloud provider. 


C. Storage area networks support block-based storage. 


B. Identity systems using federations allow multiple organizations to use the same data for 
identification when accessing the networks or resources of everyone in the group. 


B, D. Both migration WAN bandwidth and compatible VM file formats are critical to a 
successful migration. 


D. Intrusion detection systems monitor network traffic for malicious activity and generate 
reports and alerts. Intrusion prevention takes this a step further and actively attempts to 
shut down the intrusion as it is happening. 


Chapter 3: Security in the Cloud 


1. 


B. The Platform as a Service model offers operating system security provided by the service 
provider. 


B, C. Logging into a system is referred to as authentication, and the use of a token to log in 
describes two-factor authentication. 


C. The question outlines the function of a role-based access control approach. 


C. Service Organization Controls 3 reports are for public disclosure of financial controls 
and security reporting. 


10. 


11. 


12. 


13. 


14. 


15. 


16. 


17. 


18. 
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B. The National Institute of Standards and Technology (NIST) FIPS 140-2 publication 
coordinates the requirements and standards for cryptography modules. 


B. The Department of Defense Information Assurance Certification and Accreditation 
Process (DIACAP) is the process for computer systems IT security. DIACAP compliance is 
required to be certified to meet the U.S. Department of Defense security requirements for 
contractors. 


B. The Health Insurance Portability and Accountability Act defines the standards for 
protecting medical data and is mandatory for Mary’s requirements. 


A, B, E. Firewalls, load balancers, and DHCP servers are all considered cloud-based 
services. 


A. The mandatory access control approach is often found in high-security environments 
where access to sensitive data needs to be highly controlled. Using the mandatory access 
control approach, a user will authenticate, or log into, a system. Based on the user’s identity 
and security levels of the individual, access rights will be determined by comparing that 
data against the security properties of the system being accessed. 


B. The Federal Risk and Authorization Management Program is a U.S. federal government 
program that outlines the standards for a security assessment, authorization, and 
continuous monitoring for cloud products and services. 


B. The company’s security policy outlines all aspects of your cloud security posture. 


B. Two-factor authentication includes something that you have and something that you 
know. 


C. Advanced Encryption Standard is a symmetrical block cipher that has options to use 
three lengths, including 128, 192, and 256 bits. AES 256 is a very secure standard, and 
it would take an extremely long time and a lot of processing power to even come close to 
breaking the code. AES has been approved and adopted by many governments, including 
the United States and Canada, to encrypt sensitive data. AES has also been adopted as a 
standard by the National Institute of Standards and Technology. 


B, C. Lightweight Directory Access Protocol and Active Directory are two technologies 
that enable SSO access to cloud resources. 


B, D. Virtual storage area networks are implemented at the SAN level, and LUN masking 
is configured on storage controllers, and they are both low-level storage access methods. 


A. Multifactor uses temporarily issued numerical tokens that must be entered at the time of 
user authentication. 


C. Secure Sockets Layer (SSL) makes up a protocol group that operates on top of TCP 
to provide an encrypted session between the client and the server. It is commonly seen on 
websites implemented as the Hypertext Transport Protocol Secure (HTTPS) protocol. 


C. Many IPSec implementations are found in routers and firewalls within VPNs, application 
security, and network security to provide a secure connection over an insecure network such 
as the Internet. 
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19. A, B, D, F. Securing user accounts and policies include installing antivirus software, 
disabling unused servers, implementing host-based firewall services, and shutting down all 
default user accounts. 


20. B. Single sign-on allows a user to log in one time and be granted access to multiple systems 
without having to authenticate to each one individually. 


Chapter 4: Implementing Cloud Security 


1. A,C,D. Cloud segmentation is the process of dividing up your cloud deployment into 
sections that allow for granular security. Common segments include compute, network, and 
storage. APIs, JSON, and XML are software constructs to enable automation. 


2. B,D. One-time numerical tokens are generated on keyfob hardware devices and 
smartphone soft-token applications. 


3. C. Applying security applications on a virtual server will cause an increase in CPU usage. 


4. C. Automation of cloud deployments was instrumental in the growth of cloud-based 
services. 


5. B,D. Storage systems and database applications are both examples of data at rest or being 
processed in the cloud. While VPNs and client encryption are valid security systems, they 
are not associated with your internal cloud security posture. 


6. C. A dashboard is a graphical portal that provides updates and an overview of operations. 


7. C. Ultimately the responsibility for data in the cloud belongs to the organization that owns 
the data. 


8. C. Orchestration systems are software packages or services that automate cloud operations. 


9. A,B,C,D,E. All of these cloud services have APIs that can be accessed for configuration 
and monitoring using standard RESTful XML and/or JSON interfaces. 


10. E. A host-based authentication detection systems will allow Jim to apply intrusion 
protection to a specific virtual machine. 


11. D. Multifactor authentication services use a token that is generated on a schedule and can 
be a numerical value. The other answers offered are not valid to the question. 


12. C. An application programming interface (API) offers programmatic access, control, and 
configuration of a device between different and discrete software components. 


13. B,C, E, F. All compliance requirements should be integrated into the complete life cycle of a 
project including the design, planning, implementation, and validation phases of the project. 


14. A,B. Extensible Markup Language (XML) and JavaScript Object Notation (JSON) 
provide a flexible way to describe data and create information formats and electronically 
share structured data between computing systems. Both are lightweight data-interchange 
formats that are easily readable for computing systems to parse and to generate. 
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15. C. Intrusion prevention systems will monitor for malicious activity and actively take 
countermeasures to eliminate or reduce the effects of the intrusion. 


16. B. SSL/TLS security is the most common remote access encryption technology and is 
commonly used in browsers and smartphone applications. MDS is a hash algorithm, and 
IPSec is a security framework; they do not apply to the question. VPNs are not as common 
as SSL/TLS for the scenario given. 


17. C,D. Temporary storage volumes that are only in existence when the VM is deployed are 
referred to as ephemeral or nondurable storage. 


18. B. It is considered a best practice to group compute resources into like segments and apply 
security to the segment. 


19. B. The command-line interface is a text-based interface to most network services that 
allows for remote and local configurations. 


20. C. Based on the information given, the description is for a vendor-based management 
application. 


Chapter 5: Maintaining Cloud Operations 


1. A. Full backups offer the advantage of a complete and up-to-date copy of your data in one 
operation. They have the disadvantage of taking a long time to perform because all the data 
in a storage system must be copied instead of just the modified data from the last backup. 


2. C,D. Cloud configuration front ends as well as automation systems using scripting or API 
calls can shut down and restart virtual machines as required. Both restarts and shutdowns 
may be performed because of a code upgrade, troubleshooting, or other needs. The 
shutdown and restart processes can be monitored through the management systems and 
dashboards that are offered by the cloud provider. If they do not respond, these systems can 
be configured to generate an alarm. 


3. A,C,E. Common patch management offerings are Chef, Puppet, and Ansible. 


4. B. A patch is a piece of software that is intended to update an application, operating 
system, or any other software-based system to fix or improve its operations. Generally, 
patches are synonymous with fixes for security vulnerabilities or any other type of 
operational bug. 


5. C. Cloning takes the master image and clones it to be used as another separate and 
independent VM. Important components of a server are changed to prevent address 
conflicts; these include the UUID and MAC addresses of the cloned server. 


6. B. A snapshot is a file-based image of the current state of a VM including the complete 
operating systems and all applications that are stored on it. The snapshot will record the 
data on the disk, its current state, and the VM’s configuration at that instant in time. 
Snapshots can be created while the VM is in operation and are used as a record of that 
VM’s state. They can be saved to roll back to at a later time. 
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A. Many corporate and most regulatory requirements will specify that the backup 

data must be located at a separate data center from the origin data center and must be 
geographically away from each other. Many cloud providers interconnect their data centers 
into regions and availability zones using very high-speed, directly connect, fiber networks 
that allow large backup sets to traverse the data network between the data centers and that 
make remote backups feasible. 


C. A version update is the process of replacing a software product with a newer version 
of the same product. Version updates can add new features, bring the system up-to-date, 
provide a rollup of all previous patches, and improve the product. 


B. Workflow automation defines a structured process for a series of actions that should 
be taken to complete a process. With cloud-based workflow services, special workflow 
applications are offered as a managed service that creates a defined sequence of events, or 
workflow, with each procedure tracked and passed to the next process in the workflow. 


C. The main function of orchestration systems is to combine and execute the multiple 
tasks that must be completed to accomplish an operation. These tasks are combined into a 
workflow that defines the order of events and steps needed to complete the operation. The 
orchestration system uses software systems and processes to carry out the workflow. 


A, D. By placing a system into maintenance mode and disabling system alerts, the 
management systems will not alert on false positives when a system undergoing regular 
maintenance does not respond when polled by management systems, and it will not send 
out unsolicited alarms because of the maintenance being performed. 


A. A hotfix is a software update type that is intended to fix an immediate and specific 
problem with a quick release procedure. 


C. Online backup storage is a system that can be accessed at any time without the 
requirement for a network administrator to mount the media into a storage system. Online 
is the most common storage design, and backups offer an always-available method to store 
and retrieve the data. 


C. A cluster is a group of tightly coupled systems designed for high availability and that 
still operate if one or more nodes is offline. 


B, C, E. Infrastructure that is part of the IaaS service provider’s area of responsibility 
includes load balancers, hypervisors, and routers. A virtual machine, database, or e-mail 
server would be the responsibility of the customer. 


B. A rolling configuration will sequentially upgrade the web servers without causing a 
complete outage and would meet the requirements outlined in the question. 


D. The manager is requesting data on the results of the quality assurance testing on the 
release. Rollout is a patch deployment process, and both automation and orchestration 
systems are used to install the patch. 


C. Blue-green is a software deployment methodology that uses two configurations for 
production that are identical to each other. These deployments can alternate between each 
other, with one being active and the other being inactive. 
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19. 


20. 


C. Incremental backups are operations based on the change of the source data since the 
last incremental backup was performed. Incremental backups can be run, for example, on 

a nightly basis and capture the changes that were made since the previous backup was run 
the night before. This allows for an efficient backup operation since only the changes in the 
past 24 hours are stored on the backup media. Incremental backups are much less time- and 
resource-consuming than a full backup and are used to complement them. 


D. Offline storage requires the administrator to make the data available by inserting a tape 
or other media into a storage system for retrieval. Offline storage can be transported to 
remote storage facilities or stored in vaults for protection. 


Chapter 6: Disaster Recovery, Business 
Continuity, and Ongoing Maintenance 


1. 


10. 


B. Asynchronous replication is when data is written to the primary first, and then later a 
copy is written to the remote site on a scheduled arrangement or in nearly real time. 


A. The hot site model is the most viable option given the requirements. A hot site is a fully 
functional backup site that can assume operations immediately should the primary location 
fail or go offline. 


B, C. The restore point and restore time objectives are the measurements for the amount of 
data lost and the time needed to get back online after an outage. 


B. Edge locations are not complete cloud data centers. They are cloud connection points 
located in major cities and offer the benefits outlined in the question. 


B. Access control systems are used to grant users object access in an operating system. For 
ongoing maintenance and best security practices, it is important to delete old and unused 
access control policies. 


B. The restore point objective is the point in time that data can be recovered; James had to 
update the RPO metric. 


B. Moving inactive data or data that is no longer being used to a separate storage facility 
for long-term storage is referred to as archiving. It can be more cost effective to store 
archived data in less expensive storage systems and still allow the cloud consumer access to 
that data for backup and retrieval as needed. 


B, F. The backup site’s network connections must be engineered to accept the expected 
traffic load and prevent bandwidth starvation. 


B. Automation systems are backend processes for frontend systems such as dashboards or 
catalogs. 


C. Firewalls contain a list of policies, or rules, that either permit or deny traffic. Over time 
as the environment changes, it is a best practice to review the firewall rules and remove or 
modify any rules that are obsolete or unused. 
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D. Stale or out-of-date domain name entries may point to servers that are no longer in use. 
Also, certain domain names may have never been removed from DNS, causing replies from 
unexpected devices. 


H. It is important to review all of your network services to address any changes required 
when implementing a disaster recovery plan. 


C. The recovery time objective is the amount of time a system can be offline during a 
disaster; it is the amount of time it takes to get a service online and available after a failure. 


E. A cold site is a backup data center provisioned to take over operations in the event 
of a primary data center failure, but the servers and infrastructure are not deployed or 
operational until needed. 


A. Synchronous replication offerings write data to both the primary storage system and the 
replica simultaneously to ensure that the remote data is current with local replicas. 


D. Cloud edge locations are often used for proximity services at remote locations that 
provide data caching locally and offloads the need for calls to the web server fleet. 


C. File transfers occur in the background from the primary data center to a backup site. 
Synchronous and asynchronous replication are ongoing file synchronization processes. 


C. Orphaned resources are cloud-based services that are left over when a service terminates 
and they are no longer needed or used. 


B. A warm site approach to recovering from a primary data center outage is when the remote 
backup of the site is offline except for critical data storage, which is usually a database. The 
warm site will host an operational database server that is in sync with the database server at 
the primary data center and is sometimes referred to as the candlelight design. 


C. DNS records can be modified by external operations and can map domain names to IP 
addresses. There you will find occurrences of DNS entries not being deleted and becoming 
stale over time. 


Chapter 7: Cloud Management 


1. 
2. 


G. All of the options given are valid metrics for establishing a baseline. 


C. The establishment of average usage over time is the data that gets collected for a 
baseline report. 


C. Password complexity defines password length, if it is a nondictionary word and if upper/ 
lowercase or special characters are required. 


D. A lockout policy can be applied to an account that defines the parameters that create 

a lockup event. It is most common to apply a lockout policy to failed login attempts. For 
example, you can define a policy where four failed login attempts in five minutes will disable 
an account for thirty minutes. A lockout policy will most likely be defined by your information 
security group, and you may be asked to create and apply the policy as part of your duties. 


10. 


11. 


12. 
13. 


14. 


15. 


16. 


17. 


18. 
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A. Access control systems are user configurations that grant roles and duties to users or 
groups of users and also systems such as VMs, applications, and storage volumes. For 
example, database administrators can be given full access to manage a database application 
but be restricted from performing VM or storage operations. 


B. With the PaaS model, the cloud provider will maintain the operating system and all 
supporting infrastructure. 


C. The process of taking a large amount of event data and comparing the logs to determine 
the sequence of events is referred to as event correlation. 


C. The ability to disable an account can be helpful in situations where the account 

will need to be re-activated at a future date and does not need to be deleted. Account 
disablement can be managed in the same manner as other account operations with a web 
front end or with the use of APIs for scripted and automated processes. 


B. Resource access definitions allow access to approved resources, and these permissions 
contain any number of rights, such as read-write permissions for a storage volume and 
access to run certain applications. Not only access permissions can be defined, but detail on 
what functions the user is allowed to perform can be defined. 


A. Once the collection policy has been created, it can be reused and applied to other objects 
as they are created or migrated. Event collection policies reduce the amount of management 
overhead and enforce consistency in your deployments. 


A, B, D. Cloud computing operates with a utility business model that charges you only for the 
resources you consume. This model enables you to scale your cloud fleet to meet its current 
workload and be able to add and remove capacity as needed. There are many options to use 
elasticity to scale cloud operations including vertical and horizontal scaling and bursting. 


F. All of the answers offered are valid event notification service receivers. 


B. The measurement of the difference between a current reading and the baseline value is 
referred to as the variance. 


B. Scaling up, or vertical scaling, will add resources such as CPU instances or more RAM. 
When you scale up, you are basically increasing your compute, network, or storage capabilities. 


C. Cloud automation systems offer the ability to dynamically add and remove resources as 
needed; this is referred to as elasticity. 


B. Cloud bursting allows for adding capacity from another cloud service during times when 
additional compute resources are needed. 


A, B. Mergers and acquisitions may necessitate combining two cloud operations into one single 
system. You should be prepared to work with new groups and departments to look at how the 
other company’s cloud deployment is architected and what options are available to integrate 
them. Applications may be duplicated, and there could be efficiencies gained by integrating them. 


C. Change management includes recording the change, planning for the change, testing 
the documentation, getting approvals, evaluating and validating, writing instructions for 
backing out the change if needed, and doing post-change review if desired. 
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F. Managing the life cycle of an application will include deployments, upgrades, 
migrations, feature additions and deletions, replacements, and retirements. 


C. The higher up the services stack you go, from IaaS to SaaS, the more difficult it will 

be to migrate. With IaaS, most of the cloud operations are under your direct control, 
which gives you the most flexibility to migrate. However, if the cloud provider controls the 
application, you may not have many options to migrate. 


Chapter 8: Cloud Management 
Baselines, Performance, and SLAs 


1. 


10. 
11. 


12. 


B. Ifa server is using all of its network bandwidth, then the most logical solution is to add 
more. You can do this by installing a second network adapter and connecting it to a different 
subnet. The other solutions could conceivably address the problem, but the success is less likely. 


D. Performance baselines characterize hardware performance, so the OS update history 
would be of little or no use for future comparisons. A server baseline typically consists of 
CPU, memory, disk, and network performance statistics. 


E. Vertical scaling is the process of upgrading or replacing a server with one that has 
greater capabilities. 


A, D, E. Incident reports include events such as opening trouble tickets and contacting 
customer support and outages. Scaling and service level agreements are not considered 
impairments. 


A. Most databases are designed to scale vertically. 


C, D. Service level agreements outline performance and availability commitments and not 
configurations. 


A, B, D, E. Cloud reporting is intended for internal corporate groups such as marketing, 
management, accounting, and operations. 


D. Objects are queried to gather metric data. 


D. Cloud reports are formatted collections of data contained in the management or 
monitoring applications. 


C. A dashboard is a configurable graphical representation of current operational data. 


C. After performing a major system upgrade, you should collect new baseline data as the 
overall system performance has changed. 


A, D, E. CPU, RAM, and network utilization are all important object to manage for 
capacity and utilization tracking. Storage volume tiers and OS versions do not apply to this 
scenario. 
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A, B, D, E. Autoscaling allows for adding and removing cloud compute capacity, providing 
capacity changes based on the time of day, and maintaining a minimum number of VMs. 
Report generation and SLA object tracking are not autoscaling functions. 


B, E. Both Excel and PDF are the most common reporting formats. The other database, 
programming, and scripting options are not applicable to report generation. 


A. Horizontal scaling is the process of adding additional servers for increased capacity. 
Round robin is a load-balancing metric and does not apply. Elasticity is the ability to 
add and remove resources, autoscaling is the automated process of adding and removing 
capacity, and vertical scaling is expanding a server. 


A, C, D. Databases return data from read operations and are a critical performance metric. 
CPU saturation could cause a slowdown as well as network issues such as packet loss. 


B, E, F. Trends, usage, and deficiencies are all management report outputs that can be 
identified using object tracking. 


A, C, D. Server performance can be increased by adding additional CPU processing, memory, 
and network capacity. SLA, ACL, and DNS are not related to increasing server capacity. 


B. Tracking object performance data should match with the guaranteed levels outlined in 
the service level agreement. 


A, C, D. High-performance computing relies on the servers being in close proximity to 
reduce network and storage latency. Being in the same availability zone, in the same group, 
and on the same hypervisor accomplishes this. There is no such thing as a group cache. 


Chapter 9: Troubleshooting 


A, C, D. Resources such as the amount of RAM needed, CPU cycles, and storage capacity 
are common systems that may become saturated as your cloud compute requirements grow. 


C. Database read and write requests utilize storage I/O and should be the focus for 
troubleshooting. 


A, C, D. When troubleshooting, it is helpful to have access to configurations, 
documentation, and diagrams to provide information on your cloud deployment. 


D. Cloud autoscaling can dynamically add server capacity based on loading. 


B. A large number of users downloading a new application would cause an increase in 
network bandwidth usage. 


E. Any of these answers would be correct depending on his licensing agreement with the 
database provider. 


B, C, D. In addition to the web servers, IP addresses may be required for the NTP and DNS 
services and the default gateway. 
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10. 


11. 


12. 


13. 


14. 


15. 


16. 


17. 


18. 


19. 
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C. Elasticity allows for cloud services to expand and contract based on actual usage and 
would be applicable to increasing storage capacity. 


B. When troubleshooting cloud performance issues, the current number of users on the 
system can be an important indicator of load. When there are high user counts, you can 
track what parts of your deployment are most heavily used and track the load on all the 
devices to see where the congestion points are. 


D. A baseline measurement is used as a reference to determine cloud capacity increases and 
decreases. 


B. The cloud service provider owns its automation and orchestration systems, and they 
cannot be directly accessed by the customer. 


C. The change management process would need to be modified to prevent one change from 
affecting another that is taking place simultaneously. 


C. The domain name system records need to be changed to reflect the new IP address 
mapped to the domain name. 


B. Templates are software definitions of a cloud network and are used for automated 
deployments. 


C. Workflow applications track a process from start to finish and sequence the applications 
that are required to complete the process. 


A, B, D. Symptoms of reaching the capacity boundary of a service include the application 
failing, increased delays, and latency and requests to drop. 


B. The common measurement for an API request is total connections performed each second. 
C. It is common for batch processing to be performed on database applications. 


B, C. The total number of CPU cores and clock speed are common parameters to define 
when configuring a machine image. 


. D. The subnet mask determines the size of a IP network. 


Chapter 10: Troubleshooting Networking 


a 


nd Security Issues and Understanding 


Methodologies 


1. 


D. SSH is the encrypted version of the Telnet protocol and is used to access remote devices 
using a command-line interface. RDP is a Windows graphical interface. Telnet does not 
offer encryption, and terminal servers offer serial port access but may or may not support 
encrypted network access. 


4. 


10. 


11. 


Chapter 10: Troubleshooting Networking and Security Issues 343 


C. tcpdump allows a Linux system to capture live network traffic and is useful in 
monitoring and troubleshooting. Sometimes called sniffing, tcpdump allows you to set up 
filters to select the traffic you are interested in capturing for troubleshooting. Think of 
tcpdump as a command-line network analyzer. dig and nslookup show DNS resolution 
but do not display the actual packets going across the wire. netstat shows connection 
information and is not DNS related. 


C. ARP is the protocol that determines the mapping of an IP address to the physical MAC 
address on a local network. The mappings can be seen with the arp command-line utility. 
dig is used for DNS resolution, ipconfig shows the network adapter parameters, and 
netstat shows connections. 


A. The tracert and traceroute utilities are useful for network path troubleshooting. 
This utility shows the routed path a packet of data takes from source to destination. You 
can use it to determine whether routing is working as expected or whether there is a route 
failure in the path. The other answers were all incorrect as they do not provide network 
path data. 


C, E. Common remote access tools include RDP, SSH, and terminal servers. IDSs/IPSs are 
for intrusion detection, and DNS is for domain name to IP address mappings and is not a 
utility for remote access. 


C. Of the options given, the web approach does not require any local application 
installations and offers a graphical systems management interface. 


E. Ina data center, terminal servers are deployed and have several serial ports, each cabled 
to a console port on a device that is being managed. This allows you to make an SSH or 

a Telnet connection to the terminal server and then use the serial interfaces to access the 
console ports on the devices you want to connect to. The other options given do not provide 
serial port connections. 


B. The question is asking about being able to access a specific cloud service. This would 
concern Jill having authorization to access the storage volume. Authentication and SSO are 
login systems and not rights to services. A federation links user databases. 


B. The question shows that the load balancer is terminating SSL/TLS traffic from the web. 
SSL certificates have expiration dates and so, as part of the troubleshooting approach, 
security certificate expirations need to be investigated. The other options do not accomplish 
this requirement. 


A. Logging into systems is referred to as authentication. Also, the question references 
multifactor authentication (MFA) as part of the system. Authorization is the access of 
services after the authentication process, federations interconnect external user accounts 
to the cloud, and single sign-on (SSO) allows a user to authenticate one time to access all 
resources in the cloud. 


A. The top-down approach references the OSI model; it starts at the application layer and 
works downward until the problem is identified. The application is checked first, and if 
that is operational, you continue to work down the network stack until you identify the 
problem. 
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12. 


13. 


14. 
15. 


16. 


17. 


18. 


19. 


20. 
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B. The bottom-up approach starts at the lowest level of the ISO model with the physical 
network connections, such as cabling, and works upward by investigating VLANs, IP 
addressing, and so on, until the issue is located. 


C. The divide-and-conquer troubleshooting approach starts in the middle of the OSI 
networking stack and, depending on the results, directs future tests. In this case, the 
troubleshooter began at the network layer, which is in the middle of the OSI model. This is 
the divide-and-conquer approach. 


A, B, C, D, E. All of the answers given are common troubleshooting steps. 


C. Infrastructure security is the hardening of the facility and includes the steps outlined in 
the question including nondescript facilities, video surveillance, and biometric access. 


C. A secure Internet-based connection would be a VPN. 


B. The Windows Remote Desktop Protocol allows for remote connections to a Windows 
graphical user desktop. 


D. The ping utility verifies end-to-end network connectivity and is the correct answer. The 
other options offered either do not apply such as tcpdump and netstat or are not valid 
utilities such as arproute. 


B, D. nslookup is a Windows command-line utility for resolving domain names to IP 
addressing. The Linux equivalent is the dig utility. The other answers offered are not valid 
for the solution required in the question. 


C. The Linux command ifconfig will display all network-related configuration 
information for that computer and is the correct answer. ipconfig is the Windows 
equivalent and is not relevant to this question. netstat and the query string are not 
applicable to the question. 
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Chapter 1: An Introduction to Cloud 
Computing Configurations and 
Deployments 


Software 

Infrastructure 

Platform 

Ubiquitous access 
Virtualization 

Direct connection, VPN 
Replication 

Load balancers 

SSH, RDP 


10. Baselines 


O On og tr WN = 


Chapter 2: Cloud Deployments 


Memory ballooning 
Storage area network 
Fault tolerance 
Synchronous replication 
Virtual-to-virtual 
Application portability 
Federations 


Load balancer 


©OonNnonF WN = 


Benchmark 


10. Intrusion prevention system 


Chapter 3: Security in the Cloud 


1. Know, have 
2. Security policy 


3. Discretionary access 


Chapter 5: Maintaining Cloud Operations 347 


4. Single sign-on 

5. Cipher 

6. Automation 

7. Object 

8. Shared 

9. Public key infrastructure 


10. Software as a Service 


Chapter 4: Implementing Cloud Security 


Graphical user interface 


Intrusion prevention systems 


1. Data classification 
2. Segmentation 

3. At rest 

4. Know, have 

5. Automation 

6. API 

7. 

8. 

9. 


CPU 


10. Automation 


Chapter 5: Maintaining Cloud Operations 


Blue-green 

Rolling update 
Rollback 
Snapshots cloning 
Backup target 
Replicas 

Hotfix 

Differential backup 


O o N O 0 eow NS 


System alerts 


10. Backup window 
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Chapter 6: Disaster Recovery, Business 
Continuity, and Ongoing Maintenance 


Archiving 

Disaster recovery 
Business continuity 
Disaster recovery 
Inactive 
Replication 

RPO, RTO 

Logs 


PON anaAwn a 


Orphaned resources 


10. Synchronous 


Chapter 7: Cloud Management 


Metric 

Orchestration 
Anomaly 

Trigger 
Infrastructure, SLA 
Change management 
Lifecycle management 


Permissions 


Con oat wh = 


Complexity 
10. Back out 
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Chapter 8: Cloud Management 
Baselines, Performance, and SLAs 


Baseline 
Metric 
Objects 
Horizontal 
Memory 
Latency 
Resiliency 


Service level agreement 


eo On oO fF SO NS 


Vertical scaling 
10. Auditing 


Chapter 9: Troubleshooting 


Templates 

Network Time Protocol 
Capacity 

Reduce load, add capacity 
Mergers, acquisitions 
Domain name, IP address 
Validate 

Log files 


oe oN oOo fs N > 


Configuration 


10. Diagrams 
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Chapter 10: Troubleshooting Networking 
and Security Issues and Understanding 
Methodologies 

QoS 


Jumbo frame 
Proxy 

123 

netstat 

dig nslookup 
Documentation 


Research 


O 0O N So! > & NS 


Internal 


10. Privilege escalation 
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access. See also connections 
RBAC (role-based access control), 88—89 
Remote Hypervisor access, 28-29 
ubiquitous access, 14 
access control 
authentication, multifactor, 120-122 
cloud deployment models, 119-120 
cloud service models 
TaaS, 118 
PaaS, 119 
SaaS, 119 
cloud-based objects 
authentication, 116 
authorization, 116 
compute systems, 117 
network-based control, 117 
SAN, 118 
securing services, 118 
storage access, 117-118 
user accounts, 117 
user groups, 117 
VSAN, 118 
discretionary access, 121 
MAC (mandatory access control), 
120-121 
maintenance automation, 202 
nondiscretionary access, 121 
RBAC (role-based access control), 120 
SSO (single-sign on), 122 
accounting, 255 
accounts 
automation, 233-234 
creating, 233 
disabling, 234 
life cycle, 232 
mismatched, 277 
orchestration, 233-234 
permission settings, 234 
removing, 234 
resource access, 234 
addresses, troubleshooting, 274-275 


AH (authentication header), 109 
alert methods, deployment and, 218 
alert triggers, deployment and, 218-219 
anomalies, deployment and, 217-218 
antivirus software, 115, 142 
APIs (application programming interfaces) 
capacity, troubleshooting, 273 
security automation and, 138 
applications, 13 
life cycle, 228 
deployments, 229 
features, 229 
migrations, 229 
replacements, 229 
retirements, 229 
upgrades, 229 
migration, portability, 86 
patching and, 157 
archiving data, disaster recovery, 191 
ARP (Address Resolution Protocol), 298-299 
asynchronous replication, 23-24 
audits, object tracking and, 247 
authentication, 88-89 
multifactor, 88, 120-122 
hardware keyfob, 135 
login screen, 135 
smartphone-based token, 136 
resources and, 231 
SSO (single sign-on) systems, 90 
storage security, 81 
troubleshooting, 311 
authorization 
cloud services, 89 
resources and, 232 
troubleshooting, 311-312 
automation, 13, 25, 32 
accounts, 233-234 
elasticity, 256 
maintenance 
ACLs, 202 
DNS entries, stale, 199-200 
firewalls, 200-201 
inactive account removal, 199 
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log files archive, 198 
orphaned resources, 200 
resource reclamation, 201 
rules, outdated, 200-201 
storage compression, 199 
security, 114 
APIs, 138 
CLI, 138 
dashboards, 139 
GUIs, 138-139 
portals, 139 
tools, 137 
vendor-based solutions, 138 
setup, 52 
tool incompatibility, 278 
troubleshooting, 267-268, 276-280 
workflow 
orchestration, 163-164 
runbooks, 163 
availability, 215 
regions and, 27 
zones, 28 
AZs (availability zones), 28 





backups 
backup window, 171 
block change tracking, 169 
block-level backups, 167 
business continuity and, 194 
cloning, 167, 168 
configurations, 171-172 
delta change tracking, 169 
dependencies, 172 
differential, 169 
disaster backups, 167 
file backups, 167 
full backup, 168 
ghosting, 167 
image backups, 167 
incremental, 169 
objects, 172 
offline storage, 172 
online storage, 172 
recovery sites, 194-195 
scheduling, 171 
SLAs (service level agreements), 171 
snapshots, 168 
targets, 169 


local backups, 170 
remote backups, 170-171 
replicas, 170 
bandwidth, troubleshooting, 273-274, 296 
bare-metal server, 14-15 
baselines, 33, 245 
compute tuning, 251-252 
deployment and, 217 
exceeding, 275-276 
network changes, 252 
object tracking and, 246 
application versions, 247 
audit process, 247 
CPU usage, 247 
network usage, 248 
patch versions, 248-249 
RAM usage, 249 
storage usage, 249 
tool compliance, 247-248 
performance trending and, 250 
SaaS solutions, 253 
SLAs (service level agreements) and, 251 
storage tuning, 252-253 
troubleshooting, 275-276 
validation, 250-251 
benchmarks, 62, 66 
block changes, 169 
blue-green model of patching, 159-160 
bottom-up approach to troubleshooting, 316 
BPaaS (Business Process as a Service), 7, 
10-11 
business continuity, 183, 192 
alternate sites, 193 
availability zones, 193 
backups, 194 
continuity of operations, 193 
corporate policies, 184-185 
edge sites, 194 
network connectivity, 193-194 
recovery sites, 194-195 
SLAs (service level agreements), 195-196 


Cc 


CaaS (Communications as a Service), 7, 10 
capacity, troubleshooting, 272-273 

API requests, 273 

bandwidth, 273-274 

baselines, exceeding, 275-276 

batch job scheduling, 274 





boundaries, 273 
compute resources, 274 
expansions, unplanned, 276 
network addressing, 274-275 
storage, 275 
users, numbers, 275 
certificate services, 91 
troubleshooting, 312 
change management 
action plan documentation, 223-224 
back-out plans, 223-224 
breakdown troubleshooting, 277 
change advisory board, 223 
change approvals, 223 
corporate changes, 229-230 
troubleshooting and, 317-318 
chargebacks, 255 
ciphers 
3DES (Triple Data Encryption Standard), 
110-111 
AES (Advanced Encryption Standard), 110 
block ciphers, 110 
DSA (Digital Signature Algorithm), 111 
RC4 (Rivest Cipher 4), 111 
RCS (Rivest Cipher 5), 111 
RSA, 111 
stream ciphers, 110 
ciphertext, 108 
CLI (command-line interface), security 
automation and, 138 
client-server computing, 6 
cloning, 168 
cloud 
community cloud, 55 
off-premise hosting, 12 
on-premise hosting, 12 
development networks, 19 
hybrid, 13, 55 
moving to, preparation, 15 
organizational uses, 19-20 
private cloud, 11, 55 
production networks, 20 
public cloud, 54 
quality assurance networks, 20 
service provider, 3 
cloud bursting, 224, 225 
cloud computing, 3, 7 
advantages, 4 
architecture, 15-16 
energy savings, 66 
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in-house computing comparison, 4—5 
NIST description, 3 
on-demand, 20 
resources, 14-15 
cloud deployment models, security and, 
119-120 
cloud management, 214 
deployment monitoring, 216-217 
network topology, 214 
cloud service models 
access control 
TaaS, 118 
PaaS, 119 
SaaS, 119 
BPaaS (Business Process as a Service), 7, 
10-11 
CaaS (Communications as a Service), 7, 10 
DaaS (Desktop as a Service), 7, 10 
IaaS (Infrastructure as a Service), 7, 8-9 
PaaS (Platform as a Service), 7 
SaaS (Software as a Service), 7, 8 
UCaas (Unified Communications as a 
Service), 10 
XaaS (Anything as a Service), 7, 10 
cloud services 
authorization, 89 
consumers, 3 
cloud systems, scaling, 20-21 
cloud-based objects, access control 
authentication, 116 
authorization, 116 
compute systems, 117 
network-based control, 117 
SAN, 118 
securing services, 118 
storage access, 117-118 
user accounts, 117 
user groups, 117 
VSAN, 118 
clusters, patching and, 157 
co-location, 6 
community cloud, 55-56 
off-premise hosting, 12 
on-premise hosting, 12 
community scaling, 227 
compliance 
audits, 107-108 
security implementation and, 136-137 
compute pools, 17-18 
computing, 13 
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configuration management, 222-223 
change management 
action plan documentation, 223-224 
back-out plans, 223-224 
change advisory board, 223 
change approvals, 223 
connections. See also access 
console ports, 31 
direct, 28—32 
HTTP, 31-32 
RDP (Remote Desktop Protocol), 29 
Remote Hypervisor Access, 28-29 
SSH (Secure Shell), 30-31 
virtual, 28-32 
connectivity 
reporting and, 256 
tools 
ARP, 298-299 
dig, 302-303 
ipconfig/ifconfig, 300 
netstat, 300-302 
nslookup, 302-303 
ping, 303-304 
route, 304-305 
SSH (Secure Shell), 305 
tcpdump, 305-306 
Telnet, 305 
traceroute, 306-307 
tracert, 306-307 
console ports, 31 
continuous delivery, rolling updates 
and, 159 
copy-on-write snapshots, 168 
corporate changes, 229-230 
CPU 
hyper-threading, 64 
hypervisor optimization, 64 
object tracking and, 247 
overcommitment ratios, 65 
wait time, 65 
CPU affinity, 18 
CRCs (Cyclic Redundancy Checks), 293 





D 


DaaS (Desktop as a Service), 7, 10 

VDI (virtual desktop infrastructure), 10 
dashboards 

reporting and, 256 

security automation and, 139 


data at rest, 134 
encryption, 71 
data centers, 3 
connecting to, 22 
hardware resources, 67 
data classification, 131-132 
metadata, 131 
data in-flight, 134 
data integrity, 32 
automation and, 32 
baselines and, 33 
documentation and, 33 
database utilization, 215 
delivery models, 11 
delta changes, 169 
dependencies, backups, 172 
deployment 
application life cycle, 228 
change management and, 48-49 
maintenance window, 50 
migration, 50 
models 
community, 55-56 
hybrid, 55 
private, 55 
public, 54 
security, 119-120 
monitoring, 216-217 
alert methods, 218 
alert triggers, 218-219 
anomalies, 217-218 
baselines, 217 
event collection, 220-221 
event correlation, 219-220 
event dissemination, 221 
event information, 219 
log information, 219 
multi-availability zone architecture, 133 
network 
addressing, 61 
configurations, 58 
DMZ, 60 
IDSs, 59 
IPSs, 59 
multiple on block, 61-62 
ports, 57-58 
protocols, 56-57 
VPNs, 58 
VxLAN, 60-61 
network management and, 53 
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resource pooling, 16-17 
compute pools, 17-18 
CPU affinity, 18 
memory pools, 18 
network pools, 18 
storage pools, 19 
virtual CPUs, 17 
segmentation, 132-134 
service level agreements, 62 
stakeholders and, 49 
development networks, 19 
patching and, 159 
DHCP (Dynamic Host Configuration 
Protocol), 57, 91 
disaster recovery and, 186 
DIACAP (Department of Defense 
Information Assurance Certification 
and Accreditation Process), 106 
diagonal scaling, 227 
differential backups, 169 
dig, 302-303 
direct connections, 28-32 
divide-and-conquer approach to 
troubleshooting, 317 
DMZ (demilitarized zone), 60 
DNS (Domain Name System), 57, 91 
changes, 277-278 
disaster recovery and, 186 
services, 16 
stale entries, 199-200 
troubleshooting, 291, 294 
documentation, 33 
benchmarks, 62 
initial, 14 
migration and, 50-51 
services, 51 
downtime reports, 257 
DR (disaster recovery), 65, 183 
archiving, 191 
availability zones, 186 
DHCP (Dynamic Host Configuration 
Protocol) and, 186 
DNS (Domain Name Service) and, 186 
file transfers, 191 
FTP (File Transfer Protocol) and, 186 
ISP limitations, 186 
network capacity and, 185-186 
planning, 185 
RADIUS (Remote Authentication Dial-In 
User Service) and, 186 


replication, 189 
asynchronous, 190-191 
synchronous, 190-191 
RPOs (recovery point objectives), 184 
RTOs (recovery time objectives), 184 
service providers and, 183 
site mirroring, 186-187 
candlelight design, 187 
cold sites, 188-189 
hot sites, 187 
warm sites, 187, 188 
TACACS (Terminal Access Controller 
Access-Control System) and, 186 
third-party vendors, 191-192, 195 





edge facilities, 194 
elasticity, 26 
automation and, 256 
scaling and, 228 
elements, 16 
security, 155 
updates, 161 
automation, 165 
hotfixes, 162 
maintenance mode, 166 
patches, 162 
rollbacks, 162-163 
snapshots, 164-165 
system alerts, 166 
system restart, 166 
system shutdown, 166 
version updates, 162 
virtual devices, 165 
workflow automation, 163-164 
encryption 
ciphers 
3DES, 110-111 
AES, 110 
block ciphers, 110 
DSA, 111 
RC4, 111 
RCS, 111 
RSA, 111 
stream ciphers, 110 
data at rest, 71, 134 
IPsec (IP Security) 
AH (authentication header), 109 
ciphertext, 108 
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ESP (encapsulating security 
payload), 109 
MACs (message authentication 
codes), 109 
transport mode, 108 
tunnel mode, 108 
SSL (Secure Sockets Layer) 
HTTPS, 109 
PKI, 110 
TLS, 109 
troubleshooting, 314 
ephemeral volumes, 133 
ESP (encapsulating security payload), 109 
events, deployment and 
collection, 220-221 
correlation, 219-220 
dissemination, deployment and, 221 
information, 219 
expansions, unplanned, 276 
extending scope, 228 





F 


FabricPath, 51 
failover, patching and, 160-161 
FCAPS (Fault, Configuration, Accounting, 
Performance, Security), 53 
federations, 89-90 
FedRAMP (Federal Risk and Authorization 
Management Program), 106 
file transfers, disaster recovery, 191 
files, swap files, 18 
FIPS 140-2, 106 
firewalls, 141-142 
host-based, 115 
maintenance automation, 200-201 
troubleshooting, 296-297 
FISMA (Federal Information Security 
Management), 106 
FTP (File Transfer Protocol), 56 
disaster recovery and, 186 
FTPS (File Transfer Protocol Secure), 57 
full backups, 168 


G 


gateways, default, 292-293 

GRE (Generic Routing Encapsulation), 113 

GUI (graphical user interface), security 
automation and, 138-139 








hardening a system, 114-115 
troubleshooting, 312 
hardware 
multifactor authentication token, 135 
virtualization, 6 
health reports, 257 
high-availability operations, 21-22 
HIPAA (Health Insurance Portability and 
Accountability Act), 107 
horizontal scaling, 226, 254-255 
horizontal server scalability, 215 
hotfixes, 162 
HTTP (Hypertext Transfer Protocol), 
31-32, 56 
HTTPS (Hypertext Transfer Protocol 
Secure), 56, 109 
hybrid cloud, 13, 55 
hybrid-based cloud, scaling and, 227 
hypervisors, patching and, 156 





IaaS (Infrastructure as a Service), 7, 8-9 
access control and, 118 
identity 
applications, 89 
federations, 89-90 
IDSs (intrusion detection systems), 59 
inactive accounts, 199 
incident reports, 257 
incremental backups, 169 
in-flight data, 134 
in-house computing 
client-server computing, 6 
cloud computing comparison, 4-5 
mainframe computers, 5, 6 
instance initialization time, 215 
interconnection, troubleshooting and, 269 
interoperability, troubleshooting and, 
268-269 
intrusion detection, 142-143 
IP addressing, 292 
ipconfig/ifconfig, 300 
IPsec (IP Security) 
AH (authentication header), 109 
ciphertext, 108 
ESP (encapsulating security payload), 109 
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MACs (message authentication 
codes), 109 
transport mode, 108 
tunnel mode, 108 
IPSs (intrusion prevention systems), 59 
iSCSI (Internet Small Computer Systems 
Interface), 296 
ISO (International Organization for 
Standardization) standards, 106 
ISPs, DR (disaster recovery) and, 186 
ITAR (International Traffic in Arms 
Regulations), 106 





J 


JSON (JavaScript Object Notation), security 
automation and, 138 

jumbo frames, 296 

jump servers, 140 





L 


L2TP (layer 2 tunneling protocol), 113 
language, troubleshooting and, 269 
latency, 248, 256-257 
CRCs (Cyclic Redundancy Checks), 293 
troubleshooting, 293-294 
licensing, troubleshooting and, 269-270 
load balancing, 24-25, 90-91 
load testing, 25 
logs 
deployment and, 219 
files, maintenance automation, 198 
security and, 103-104 





MAC (mandatory access control), 120-121 
MACs (message authentication codes), 109 
mainframe computers, 5, 6 
maintenance, 196 
automation, 197 

ACLs, 202 

DNS entries, stale, 199-200 

firewalls, 200-201 

inactive account removal, 199 

log files archive, 198 


orphaned resources, 200 
resource reclamation, 201 
rules, outdated, 200-201 
storage compression, 199 
operation interruptions, 197 
windows, 196-197 
malware prevention software, 142 
management systems, 52-54 
management tools, object tracking and, 247 
memory pools, 18 
metrics, 215-216, 245 
MFA (Multi-Factor Authentication), 314 
migration, 82-83 
applications 
life cycle, 228 
portability, 86 
authentication, SSO (single sign-on) 
systems, 90 
certificate services, 91 
cloud services, authorization, 89 
data, 84-85 
DHCP (Dynamic Host Configuration 
Protocol), 91 
DNS (domain name service), 91 
documentation, 50-51 
firewall security, 92-93 
identity applications, 89 
identity federations, 89-90 
infrastructure 
downtime, 87 
network capacity, 86-87 
timing, 87 
legal issues, 87 
load balancing, 90-91 
maintenance window, 50 
multilayer user authentication services, 92 
offline, 85 
online, 85 
P2V (physical-to-virtual), 83 
procedures, 50-51 
RBAC (role-based access control), 88-89 
timeline, 50 
V2P (virtual-to-physical), 84 
V2V (virtual-to-virtual), 83 
virtualization formats, 85 
workload, 86 
MPAA (Motion Picture Society of 
America), 107 
MSaaS (Managed Security as a Service), 140 
MTBF (mean time between failure), 215 
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MTSO (mean time to switchover), 215 
MTSR (mean time system recovery), 215 
MTTR (mean time to repair), 215 
MTUs (Maximum Transmission Units), 
269, 296 

multi-availability zone architecture, 133 
multifactor authentication, 88, 120-122 

hardware keyfob, 135 

login screen, 135 

smartphone-based token, 136 





NAT (network address translation), 16 
netstat, 300-302 
network management, 53 
network pools, 18 
network systems, patching and, 156-157 
networking, 13 
bandwidth, 296 
DNS (Domain Name System), 294 
firewall configuration, 296-297 
gateways, default, 292-293 
infrastructure, 293 
IP addressing, 292 
latency, 293-294 
MTUs (Maximum Transmit Units), 296 
proxy configuration, 296-297 
QoS (quality of service), 294-295 
routers, 292-293 
subnet issues, 291 
troubleshooting, 270, 290-291 
ARP, 298-299 
bandwidth, 296 
default gateways, 292-293 
dig, 302-303 
DNS, 294 
firewall configuration, 296-297 
infrastructure, 293 
IP addressing, 292 
ipconfig/ifconfig, 300 
latency, 293-294 
MTUs, 296 
netstat, 300-302 
nslookup, 302-303 
ping, 303-304 
proxy configuration, 296-297 
QoS (quality of service), 294-295 
remote access tools, 307-310 


route, 304-305 
routing, 292-293 
SSH, 305 
subnet issues, 291 
tcpdump, 305-306 
Telnet, 305 
traceroute, 306-307 
tracert, 306-307 
VLANs, 297-298 
VxLANs, 297-298 
networks 
addressing, 61 
capacity, 215, 248 
configurations, 58 
development, 20 
DMZ (demilitarized zone), 60 
IDSs (intrusion detection systems), 59 
IPSs (intrusion prevention systems), 59 
jitter, 248 
latency, 248, 256-257 
multiple on block, 61-62 
object tracking and, 248 
packet loss, 248 
ports, 57-58 
protocols 
DHCP, 57 
DNS, 57 
FTP, 56 
FTPS, 57 
HTTP, 56 
HTTPS, 56 
SFTP, 57 
SMTP, 57 
SSH, 57 
QOS (quality of service), 248 
quality assurance, 20 
topology, 214 
VPNs (virtual private networks), 58 
VxLAN (virtual extensible LAN), 60-61 
NIST (National Institute of Standards), 3 
nslookup, 302-303 
NTP (Network Time Protocol), 272 





O 


object tracking, baselines, 246 
application versions, 247 
audit process, 247 
CPU usage, 247 


network usage, 248 

patch versions, 248-249 

RAM usage, 249 

storage usage, 249 

tool compliance, 247-248 
objects, 16, 245 
offline migration, 85 
offline storage, 172 
off-premise hosting, 12 
on-demand cloud services, 26 
on-demand computing, 20 
online migration, 85 
online storage, 172 
on-premise hosting, 12 
orchestration 

platforms, 25 

security implementation, 140 

troubleshooting, 276-280 

workflow automation and, 163 
orphaned resources, 200 
outage time, 216 





P 


Paas (Platform as a Service), 7 
access control and, 119 
passwords, 114 
patch management, 158 
patching 
applications and, 157 
automation, 165 
blue-green and, 159-160 
clusters and, 157 
continuous delivery, 159 
dependencies and, 161 
development systems and, 159 
hypervisors and, 156 
maintenance mode, 166 
methodologies, 157-161 
network systems and, 156-157 
object tracking and, 248-249 
order of operations, 161 
production systems, 158 
QA tests, 159 
rolling updates, 159 
snapshots and, 164-165 
storage and, 157 
system alerts 
disabling, 166 
enabling, 166 


objects — protocols 359 


system restart, 166 
system shutdown, 166 
virtual appliances and, 156 
virtual devices, cloning, 165 
VMs and, 156 
PAYG (pay as you grow), 26 
PCI-DSS (Payment Card Industry Data 
Security Standard), 106 
penetration testing, 25 
performance, 21 
horizontal scaling and, 254-255 
metrics, 34 
vertical scaling and, 253-254 
physical resources, 62 
benchmarks, 66 
cloud data centers, 67 
CPU, 64-65 
high availability, 65 
memory, 64 
processors, 63 
physical security, 143-144 
ping, 303-304 
PKI (Public Key Infrastructure), 110, 111 
framework components, 112 
PKIaaS (PKI as a Service), 113 
PKIaaS (PKI as a Service), 113 
points of preference, 194 
policies 
reporting, 255 
security, 104-105 
portals, security automation and, 139 
PPTP (Point-to-Point Tunneling Protocol), 113 
private cloud, 11, 55 
scaling, 227 
privilege escalation, 310-311 
procedures, migration and, 50-51 
production networks, 20 
patching and, 158 
protocols 
DHCP (Dynamic Host Configuration 
Protocol), 57 
DNS (Domain Name System), 57 
FTP (File Transfer Protocol), 56 
FTPS (File Transfer Protocol Secure), 57 
HTTP (Hypertext Transfer Protocol), 56 
HTTPS (Hypertext Transfer Protocol 
Secure), 56 
SFTP (Secure File Transfer Protocol), 57 
SMTP (Simple Mail Transfer Protocol), 57 
SSH (Secure Shell), 57 


360 proxies — resources 


proxies, configuration, 296-297 
public cloud, 54 

scaling, 227-228 
push services, 218 





Q 


QoS (quality of service), 294-295 
quality assurance networks, 20 





RADIUS (Remote Authentication Dial-In 
User Service), disaster recovery 
and, 186 
RAM usage, object tracking and, 249 
RBAC (role-based access control), 88—89, 120 
RDP (Remote Desktop Protocol), 29 
redirect-on-write snapshots, 168 
reference designs, 11 
regions, availability and, 27 
regulatory requirements 
DIACAP (Department of Defense 
Information Assurance Certification 
and Accreditation Process), 106 
FedRAMP (Federal Risk and 
Authorization Management 
Program), 106 
FIPS 140-2, 106 
FISMA (Federal Information Security 
Management), 106 
HIPAA (Health Insurance Portability and 
Accountability Act), 107 
ISO (International Organization for 
Standardization) standards, 106 
ITAR (International Traffic in Arms 
Regulations), 106 
MPAA (Motion Picture Society of 
America), 107 
PCI-DSS (Payment Card Industry Data 
Security Standard), 106 
security implementation and, 
136-137 
SOC (Service Organization Controls), 
105-106 
reliability, 216 
remote access 


security 
GRE, 113 
L2TP, 113 
PPTP, 113 
tools, 307 
console ports, 307-308 
HTTP, 308-309 
RDP (Remote Desktop 
Protocol), 309 
SSH (Secure Shell), 309-310 
Remote Hypervisor Access, 28-29 
remote management 
replication and, 22-24 
VPNs (virtual private networks) 
and, 22 
replication, 22 
asynchronous, 23-24 
disaster recovery and, 189 
asynchronous, 190-191 
synchronous, 190-191 
site-to-site, 22 
synchronous, 23 
reporting 
capacity, 257 
company policies, 255 
connectivity and, 256 
dashboards, 256 
downtime, 257 
health reports, 257 
incident reports, 257 
latency, 256-257 
SLAs and, 255 
uptime, 257 
utilization, 257 
resource pooling, 16-17 
compute pools, 17-18 
CPU affinity, 18 
memory pools, 18 
network pools, 18 
storage pools, 19 
virtual CPUs, 17 
resources, 14-15 
account automation, 233-234 
account identification, 231 
account life cycle, 232 
account orchestration, 
233-234 
account provisioning, 230-231 


application life cycle, 228 
deployments, 229 
features, 229 
migrations, 229 
replacements, 229 
retirements, 229 
upgrades, 229 

authentication, 231 

authorization and 
ACLs, 232 
permission-based, 232 

cloud bursting, 224 

contention, 271 

corporate changes, 229-230 

physical, 62 
benchmarks, 66 
cloud data centers, 67 
CPU, 64-65 
high availability, 65 
memory, 63-64 
processors, 63 

providers, migration between, 224-225 

reclamation, 201 

scaling, 225 
capacity reduction, 227 
cloud bursting, 225 
community scaling, 227 
diagonal scaling, 227 
elasticity and, 228 
horizontal scaling, 226 
hybrid-based cloud and, 227 
private cloud, 228 
public cloud, 227-228 
vertical scaling, 225-226 

scope, extending, 228 

starvation, 271 

usage patterns, 224 

virtual, 63 
CPU, 64-65 
high availability, 65 
memory, 63-64 
processors, 63 

response time, 216 

REST (Representational State Transfer), 
security automation and, 138 

rollbacks, 162-163 

rolling updates, 159 

route, 304-305 


response time — security 361 


routers, 292-293 
RPOs (recovery point objectives), 
168, 184 
RTOs (recovery time objectives), 168, 184 
rules, outdated, 200-201 
runbooks, 163 


S 


SaaS (Software as a Service), 7, 8 
access control and, 119 
scalability, server 
horizontal, 215 
vertical, 216 
scaling, 20-21 
capacity reduction, 227 
cloud bursting, 224 
community scaling, 227 
diagonal scaling, 227 
elasticity and, 228 
horizontal scaling, 226, 254-255 
hybrid-based cloud and, 227 
private cloud, 228 
public cloud, 227-228 
resources and, 225 
system requirements, 26 
vertical scaling, 225-226, 254-255 
scope, extending, 228 
SCP (Secure Copy Protocol), 305 
script-based services, security 
implementation, 140 
security, 14 
access control 
applications, 120-122 
cloud deployment models, 119-120 
cloud service models, 118-119 
cloud-based objects, 116-118 
account shutdown, 116 
antivirus software, 115, 142 
automation, 114 
APIs, 138 
CLI, 138 
critical systems and, 144 
dashboards, 139 
GUIs, 138-139 
portals, 139 
tools, 137 
vendor-based solutions, 138 





362 


segmentation — site-to-site replication 


certificates, 111 
compliance audits, 107-108 
data classification, 131-132 
data protection, 107 
elements, 155 
encryption 
ciphers, 110-111 
IPsec, 108-109 
SSL, 109-110 
firewalls, 141-142 
host-based, 115 
implementation 
compliance and, 136-137 
customized approaches, 140-141 
orchestration systems, 140 
script-based services, 140 
implementation, regulatory issues, 
136-137 
intrusion detection and prevention, 
142-143 
host-based, 143 
logging and, 103-104 
malware prevention software, 142 
passwords, 114 
patches, 155 
physical security, 143-144 
PKI (public key infrastructure), 
111-113 
policies, 104-105 
regulatory requirements, 105-107 
remote access 
GRE, 113 
L2TP, 113 
PPTP, 113 
segmentation 
computing, 133-134 
storage, 133 
server patches, 115 
services, disabling, 114-115 
system hardening, 114-115 
troubleshooting 
authentication, 311 
authorization, 311-312 
availability, 314 
certificate configuration, 312 
confederations, 312 
controls maintenance, 313-314 


device hardening, 312 
encryption, 314 
external attacks, 313 
infrastructure, 314 
internal attacks, 313 
physical access, 314 
privilege escalation, 310-311 
processes maintenance, 313-314 
sign-on issues, 311 
technologies, 313 
tunneling, 314 
unencrypted data, 315 
user accounts, 114 
segmentation, 132-133 
computing, 133-134 
multi-availability zone architecture, 133 
storage, 133 
durable, 133 
ephemeral volumes, 133 
nondurable, 133 
three-tier architecture, 133 
servers 
bare-metal, 14-15 
capacity, 216 
name changes, 277-278 
scalability 
horizontal, 215 
vertical, 216 
security patches, 115 
service level agreements, 62 
service outages, troubleshooting, 271 
service providers 
disaster recovery and, 183 
guidelines, 185 
migration between, 224-225 
policies, 185 
responsibilities, 33-34 
services, security, disabling, 114-115 
SFTP (Secure File Transfer Protocol), 57, 305 
sign-on issues, 311 
site mirroring, disaster recovery and, 
186-187 
candlelight design, 187 
cold sites, 188-189 
hot sites, 187 
warm sites, 187, 188 
site-to-site replication, 22 


SLAs (service level agreements) - system requirements 363 


SLAs (service level agreements) 
backups and, 171 
maintenance responsibilities, 222 
reporting and, 255 


smartphone-based multifactor authentication 


token, 136 
SMTP (Simple Mail Transfer Protocol), 57 
snapshots 
copy-on-write, 168 
redirect-on-write, 168 
RPOs (recovery point objectives), 168 
RTOs (recovery time objectives), 168 
SNMP (Simple Network Management 
Protocol), 116 
SOC (Service Organization Controls), 
105-106 
Spanning Tree, 51 
SSH (Secure Shell), 30-31, 57, 305 
SSL (Secure Sockets Layer) 
HTTPS (Hypertext Transport Protocol 
Secure), 109 
PKI (Public Key Infrastructure), 110 
TLS (Transport Layer Security), 109 
SSO (single sign-on), 90, 122 
stakeholders, deployment and, 49 
storage, 14, 166 
access, 81 
backups 
block change tracking, 169 
block-level backups, 167 
cloning, 167, 168 
delta change tracking, 169 
differential, 169 
disaster backups, 167 
file backups, 167 
full backup, 168 
ghosting, 167 
image backups, 167 
incremental, 169 
snapshots, 168 
cloning, 74 
compression, automation, 199 
configurations, 67 
DAS, 68 
NAS, 68 
object-based storage, 69-70 
SANs, 69 


data migration, 84-85 
data replication, 73 
asynchronous replication, 74 
synchronous replication, 
74 
durable, 133 
ephemeral volumes, 133 
fault tolerance and, 73 
high availability and, 73 
mirrors, 74 
nondurable, 133 
object tracking and, 249 
offline, 172 
online, 172 
patching and, 157 
provisioning 
data at rest, encryption, 71 
thick, 70 
thin, 70-71 
token models, 72 
RAID controllers, 75 
RAID levels, 75 
RAID 0, 75 
RAID 0+1, 77 
RAID 1, 76 
RAID 1+0, 76 
RAID 5, 77 
RAID 6, 78 
scalability, 216 
security 
access, 81 
ACL, 79 
authentication, 81 
authorization, 81 
LUN masking, 79-81 
obfuscation, 79 
SAN, 79-81 
zoning, 79-81 
tiers, 72-73 
total capacity, 216 
troubleshooting, 275 
storage pools, 19 
subnet masks, 291 
support agreements, 221 
swap files, 18 
synchronous replication, 23 
system requirements, scaling, 26 


364 TACACS (Terminal Access Controller Access-Control System) - troubleshooting 





T 


TACACS (Terminal Access Controller 
Access-Control System), disaster 
recovery and, 186 

task runtime, 216 

tcpdump, 305-306 

Telnet, 305 

templates, troubleshooting, 272 

terminal services, 31 

testing 

load testing, 25 

penetration testing, 25 

QA tests, patching and, 159 
vulnerability scanning, 25 

thick provisioning, 70 

thin provisioning, 70-71 

three-tier architecture, 133 

time synchronization, 272 

timeline, migration, 50 

TLS (Transport Layer Security), 109 

token models, 72 

top-down approach to troubleshooting, 316 

traceroute, 306-307 

tracert, 306-307 

transport mode, IPsec, 108 

TRILL, 51 

troubleshooting 

accounts, mismatched, 277 
automation, 267-268, 276-280 
tool incompatibility, 278 
capacity, 272-273 
API requests, 273 
bandwidth, 273-274 
baselines, exceeding, 275-276 
batch job scheduling, 274 
boundaries, 273 
compute resources, 274 
expansions, unplanned, 276 
network addressing, 274-275 
storage, 275 
users, numbers, 275 
change management breakdowns, 277 
DNS changes, 277-278 
feature mismatches, 279 
interconnection, 269 
IP addresses, 278 


language support and, 269 
licensing issues, 269-270 
location changes, 279 
methodology, 315 

bottom-up, 316 

change management, 317-318 

distillation of issue, 318-319 

divide-and-conquer, 317 

documentation, 319-320 

information gathering, 318 

planning, 319 

research, 319 

resolution, 319-320 

testing, 319 

top-down, 316 

verification, 319 
networking, 270, 290-291 

ARP, 298-299 

bandwidth, 296 

default gateways, 292-293 

dig, 302-303 

DNS, 294 

firewall configuration, 296-297 

infrastructure, 293 

IP addressing, 292 

ipconfig/ifconfig, 300 

latency, 293-294 

MTUs, 296 

netstat, 300-302 

nslookup, 302-303 

ping, 303-304 

proxy configuration, 296-297 

QoS (quality of service), 294-295 

remote access tools, 307-310 

route, 304-305 

routing, 292-293 

SSH, 305 

subnet issues, 291 

tcpdump, 305-306 

Telnet, 305 

traceroute, 306-307 

tracert, 306-307 

VLANs, 297-298 

VxLANs, 297-298 
orchestration, 276-280 
process issues, 276-277 
resource contention, 271 


tunnel mode — XML (Extensible Markup Language) 365 


resource starvation, 271 
security 
authentication, 311 
authorization, 311-312 
availability, 314 
certificate configuration, 312 
confederations, 312 
controls maintenance, 313-314 
device hardening, 312 
encryption, 314 
external attacks, 313 
infrastructure, 314 
internal attacks, 313 
physical access, 314 
privilege escalation, 310-311 
processes maintenance, 313-314 
sign-on issues, 311 
technologies, 313 
tunneling, 314 
unencrypted data, 315 
server name changes, 277-278 
service outages, 271 
templates, 272 
time synchronization, 272 
version mismatches, 279 
work validation, 279-280 
workflow issues, 276-277 
workflow services, 272 
tunnel mode, 314 
IPsec, 108 





U 


ubiquitous access, 14 
UCaas (Unified Communications as a 
Service), 10 
uptime reports, 257 
usage patterns, resources and, 224 
user accounts 
securing, 114 
troubleshooting, 275 
users 
identity applications, 89 
RBAC (role-based access control), 88—89 





v 


VDI (virtual desktop infrastructure), 10 
vertical scaling, 225-226, 254-255 
vertical server scalability, 216 
virtual appliances, patching 
and, 156 
virtual connections, 28—32 
virtual CPUs, 17 
virtual switches, 18 
virtualization, 6, 7, 14 
formats, migration, 85 
VLANs (virtual LANs), 51, 291 
troubleshooting, 297-298 
VMs (virtual machines), 14 
patching and, 156 
VNI (VxLAN Network Identifier), 298 
vNIC (virtual network interface 
card), 18 
VPNs (virtual private networks), 
22, 58 
troubleshooting and, 269 
vulnerability scanning, 25 
VxLANs (Virtual Extensible LANs), 51, 
60-61, 291 
troubleshooting, 297-298 


Ww 


web server utilization, 216 
workflow, 52 
automation, 163 
orchestration, 163-164 
runbooks, 163 
services, troubleshooting, 272 
troubleshooting, 276-277 
workload migration, 86 





X-Y-Z 


XaaS (Anything as a Service), 7, 10 
XML (Extensible Markup Language), 
security automation and, 138 


Comprehensive Online 
Learning Environment 


Register to gain one year of FREE access to the online interactive learning 
environment and test bank to help you study for your CompTIA Cloud:+ certification 
exam—included with your purchase of this book! 


The online test bank includes the following: 


e Assessment Test to help you focus your study to specific objectives 

e Chapter Tests to reinforce what you’ve learned 

e Practice Exams to test your knowledge of the material 

e Digital Flashcards to reinforce your learning and provide last-minute test prep before 
the exam 

e Searchable Glossary to define the key terms you'll need to know for the exam 


Register and Access the Online Test Bank 


To register your book and get access to the online test bank, follow these steps: 


1. Go to bit. ly/SybexTest. 

2. Select your book from the list. 

3. Complete the required registration information including answering the security 
verification proving book ownership. You will be emailed a pin code. 

4. Go to http: //ww.wiley.com/go/sybextestprep and find your book on that page and click 
the “Register or Login” link under your book. 

5. If you already have an account at testbanks.wiley.com, login and then click the “Redeem 
Access Code” button to add your new book with the pin code you received. If you don’t 
have an account already, create a new account and use the PIN code you received. 


4 SYBEX 


( 
N f 
A Wiley Brand 


WILEY END USER LICENSE 
AGREEMENT 


Go to www.wiley.com/go/eula to access Wiley’s ebook 
EULA. 


